3 people f5f4b58958 fix: harden model profile image against SVG stored XSS (#25060) ...

ModelMeta.profile_image_url now runs validate_profile_image_url, rejecting SVG/script data URIs (matching UserUpdateForm and ChannelWebhookForm). The /model/profile/image endpoint enforces the PROFILE_IMAGE_ALLOWED_MIME_TYPES allowlist and sets X-Content-Type-Options: nosniff, so an SVG data URI can no longer be served inline on-origin. Closes the fourth profile-image XSS sink missed by the user and webhook fixes.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-28 17:41:55 -05:00

..

data

…

internal

refac

2026-05-21 16:25:25 +04:00

migrations

refac

2026-05-21 15:29:49 +04:00

models

fix: harden model profile image against SVG stored XSS (#25060)

2026-05-28 17:41:55 -05:00

retrieval

refac

2026-05-21 16:44:36 +04:00

routers

fix: harden model profile image against SVG stored XSS (#25060)

2026-05-28 17:41:55 -05:00

socket

fix: resolve NameError for redis_sentinels in session_cleanup_lock

2026-05-21 13:41:21 +04:00

static

refac

2026-05-12 03:04:35 +09:00

storage

refac: modernize type annotations (PEP 604 / PEP 585)

2026-05-12 17:10:15 +09:00

tools

fix: add knowledge_id access check in search_knowledge_files (BOLA) (#25113)

2026-05-28 16:23:49 -05:00

utils

fix(auth): use request.scope["path"] to prevent CVE-2026-48710 (BadHost) (#25123)

2026-05-28 16:41:56 -05:00

__init__.py

refac

2026-05-09 02:38:08 +09:00

alembic.ini

…

config.py

refac

2026-05-21 16:56:56 +04:00

constants.py

refac: modernize type annotations (PEP 604 / PEP 585)

2026-05-12 17:10:15 +09:00

env.py

refac

2026-05-20 00:22:27 +04:00

functions.py

fix: emit [DONE] for AsyncGenerator pipe returns (#24763)

2026-05-19 22:07:56 +04:00

main.py

refac

2026-05-21 16:56:56 +04:00

tasks.py

refac: modernize type annotations (PEP 604 / PEP 585)

2026-05-12 17:10:15 +09:00