This repository has been archived on 2026-05-24. You can view files and clone it. You cannot open issues or pull requests or push a commit.
Files
app/apps/web
Test User b00d6a8ca0 fix(GRO-642): restrict allowed logo MIME types to bitmap formats only
Exclude image/svg+xml from the frontend allowlist since SVG poses greater
XSS risk due to its ability to contain scripts, even with proper Content-Type
validation. The server-side validation (commit 8182870) still accepts SVG
and validates magic bytes, but the frontend restrict to safer bitmap formats
as specified in the issue.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-04-17 06:46:24 +00:00
..