Amruth Pillai 61f481055a fix(server): serve untrusted uploads as downloads ...

S3 and Vercel Blob hand back the content type the client declared at
upload time, and the upload proxy served it inline on the app origin, so
an uploaded text/html or image/svg+xml file could run script as the app.

Only raster images (gif, jpeg, png, webp) now render inline; everything
else, PDFs included, is served as an application/octet-stream
attachment. The check runs at serve time, so it also covers objects
stored before this change.

2026-09-29 22:07:00 +02:00

..

server

fix(server): serve untrusted uploads as downloads

2026-09-29 22:07:00 +02:00

web

fix(web): keep every document in the account export zip

2026-09-29 22:03:19 +02:00