olaf/Link-Log
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 4 Wiki Activity

SA-010 Avatar validation

Browse Source
This commit is contained in:
olaf
2026-08-26 18:35:12 +02:00
parent b971d2ed97
commit ed76b35600
8 changed files with 62 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
VIBE/CHAT_LOG.md
+6
View File
@@ -1,5 +1,11 @@
# Chat Log
### User
Solve SA-010: Avatar validation trusts the client MIME type.
### Assistant outcome
Completed avatar hardening with Pillow: uploads are size-limited, decoded and verified rather than trusted by MIME type, bounded to 25 megapixels, fully loaded, normalized to PNG, and served under a fixed `.png` path. Tests now verify PNG normalization and rejection of fake image bytes. SA-010 is marked remediated with `nosniff` and media-origin isolation retained as deployment hardening.
### User
Run full backend and frontend test suites.