multica

mirror of https://github.com/multica-ai/multica.git synced 2026-07-05 13:29:44 +02:00

Files

Bohan Jiang 424f67f7cb fix(security): normalize MIME type in isInlineContentType (#3050 )

isInlineContentType is the security boundary that decides whether an
uploaded file is served with Content-Disposition: inline (renderable
in the document origin) or attachment. The SVG carve-out added in
#3023 to block stored-XSS via uploaded .svg only matched the exact
literal "image/svg+xml", so callers that supply "IMAGE/SVG+XML",
"image/svg+xml; charset=utf-8", or whitespace-padded variants would
still see disposition=inline. MIME type matching is case-insensitive
per RFC 2045 §5.1 and may carry parameters, so the safe thing is to
normalize at the boundary instead of trusting every caller.

Today both call sites (S3.Upload and LocalStorage.Serve) happen to
feed in the exact literal because the upload handler overrides .svg
to "image/svg+xml" before storage sees it, so this is defense-in-depth
rather than a live regression. Hardens the helper so any future caller
(including one that ever trusts a client-supplied Content-Type) stays
behind the same guard.

Co-authored-by: multica-agent <github@multica.ai>

2026-05-22 13:01:52 +08:00

local_test.go

fix(security): force attachment disposition for SVG uploads (#3023 )

2026-05-22 12:51:43 +08:00

local.go

feat: in-app preview for non-image attachments (#2528 )

2026-05-13 18:24:15 +08:00

s3_test.go

fix(storage): build region-qualified S3 public URLs (#2051 ) (#2065 )

2026-05-06 12:45:55 +08:00

s3.go

feat: in-app preview for non-image attachments (#2528 )