olaf/Link-Log
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 4 Wiki Activity

SA-010 Avatar validation

Browse Source
This commit is contained in:
olaf
2026-08-26 18:35:12 +02:00
parent b971d2ed97
commit ed76b35600
8 changed files with 62 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
VIBE/CHAT_LOG.md
+6
View File
@@ -1,5 +1,11 @@
# Chat Log
### User
Solve SA-010: Avatar validation trusts the client MIME type.
### Assistant outcome
Completed avatar hardening with Pillow: uploads are size-limited, decoded and verified rather than trusted by MIME type, bounded to 25 megapixels, fully loaded, normalized to PNG, and served under a fixed `.png` path. Tests now verify PNG normalization and rejection of fake image bytes. SA-010 is marked remediated with `nosniff` and media-origin isolation retained as deployment hardening.
### User
Run full backend and frontend test suites.
VIBE/PROMPTS.md
+1
View File
@@ -188,6 +188,7 @@
183. Fix SA-009: TOTP enrollment has no recovery codes or reset workflow.
183. Address SA-007 and use linklog.example.com as the default LINKLOG_PUBLIC_URL.
184. Run full backend and frontend test suites.
185. Solve SA-010: Avatar validation trusts the client MIME type.
## Future entries