maaz519/iios
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(media): allow HTML/Markdown/CSV uploads; serve scriptable types as downloads #5

Merged
maaz519 merged 1 commits from feat/s3-storage into dev 2026-07-20 09:01:57 +00:00
Conversation 0 Commits 1 Files Changed 3
+23 -1
maaz519 commented 2026-07-20 09:01:49 +00:00
Owner
Copy Link
Copy Source
  • media upload policy now allows text/html, text/markdown, text/x-markdown,
    text/csv (in addition to images/av, pdf, txt, zip, office docs)
  • blob endpoint adds X-Content-Type-Options: nosniff, and forces
    Content-Disposition: attachment for script-capable types (html, xhtml, svg,
    xml) so an uploaded file can't render/execute inline from the IIOS origin
    (stored-XSS). Images/video/audio/pdf still serve inline for preview.
  • dev-opa test covering the allowed types + unknown/oversize denials

Co-Authored-By: Claude Opus 4.8 noreply@anthropic.com

- media upload policy now allows text/html, text/markdown, text/x-markdown, text/csv (in addition to images/av, pdf, txt, zip, office docs) - blob endpoint adds X-Content-Type-Options: nosniff, and forces Content-Disposition: attachment for script-capable types (html, xhtml, svg, xml) so an uploaded file can't render/execute inline from the IIOS origin (stored-XSS). Images/video/audio/pdf still serve inline for preview. - dev-opa test covering the allowed types + unknown/oversize denials Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
maaz519 added 1 commit 2026-07-20 09:01:50 +00:00
feat(media): allow HTML/Markdown/CSV uploads; serve scriptable types as downloads b4104b9769 
- media upload policy now allows text/html, text/markdown, text/x-markdown,
  text/csv (in addition to images/av, pdf, txt, zip, office docs)
- blob endpoint adds X-Content-Type-Options: nosniff, and forces
  Content-Disposition: attachment for script-capable types (html, xhtml, svg,
  xml) so an uploaded file can't render/execute inline from the IIOS origin
  (stored-XSS). Images/video/audio/pdf still serve inline for preview.
- dev-opa test covering the allowed types + unknown/oversize denials

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
maaz519 merged commit 00d22be714 into dev 2026-07-20 09:01:57 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
abhinav (Abhinav Kapoor) maaz519 (Maaz Ahamed)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: maaz519/iios#5
Delete Branch "feat/s3-storage"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?