Classic298andClaude Opus 4.7 f5f4b58958 fix: harden model profile image against SVG stored XSS (#25060) ...

ModelMeta.profile_image_url now runs validate_profile_image_url, rejecting SVG/script data URIs (matching UserUpdateForm and ChannelWebhookForm). The /model/profile/image endpoint enforces the PROFILE_IMAGE_ALLOWED_MIME_TYPES allowlist and sets X-Content-Type-Options: nosniff, so an SVG data URI can no longer be served inline on-origin. Closes the fourth profile-image XSS sink missed by the user and webhook fixes.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-28 17:41:55 -05:00

..

analytics.py

refac: modernize type annotations (PEP 604 / PEP 585)

2026-05-12 17:10:15 +09:00

audio.py

refac

2026-05-21 18:43:45 +04:00

auths.py

refac

2026-05-21 16:56:56 +04:00

automations.py

refac: modernize type annotations (PEP 604 / PEP 585)

2026-05-12 17:10:15 +09:00

calendar.py

fix: check destination calendar write access on event update (#24764)

2026-05-19 21:26:58 +04:00

channels.py

refac

2026-05-19 20:44:38 +04:00

chats.py

refac

2026-05-21 16:56:56 +04:00

configs.py

refac: modernize type annotations (PEP 604 / PEP 585)

2026-05-12 17:10:15 +09:00

evaluations.py

refactor: remove unused GET /evaluations/feedbacks/all endpoint (#24778)

2026-05-19 20:49:22 +04:00

files.py

refac

2026-05-20 01:30:26 +04:00

folders.py

refac: modernize type annotations (PEP 604 / PEP 585)

2026-05-12 17:10:15 +09:00

functions.py

refac: modernize type annotations (PEP 604 / PEP 585)

2026-05-12 17:10:15 +09:00

groups.py

refac

2026-05-14 13:12:59 +09:00

images.py

refac

2026-05-14 02:40:20 +09:00

knowledge.py

refac

2026-05-28 17:24:33 -05:00

memories.py

refac

2026-05-21 14:01:57 +04:00

models.py

fix: harden model profile image against SVG stored XSS (#25060)

2026-05-28 17:41:55 -05:00

notes.py

refac: modernize type annotations (PEP 604 / PEP 585)

2026-05-12 17:10:15 +09:00

ollama.py

refac

2026-05-25 20:15:03 +04:00

openai.py

refac

2026-05-20 00:26:22 +04:00

pipelines.py

refac: modernize type annotations (PEP 604 / PEP 585)

2026-05-12 17:10:15 +09:00

prompts.py

refac

2026-05-21 14:01:57 +04:00

retrieval.py

refac

2026-05-21 16:56:56 +04:00

scim.py

refac: modernize type annotations (PEP 604 / PEP 585)

2026-05-12 17:10:15 +09:00

skills.py

refac: modernize type annotations (PEP 604 / PEP 585)

2026-05-12 17:10:15 +09:00

tasks.py

refac

2026-05-14 13:19:00 +09:00

terminals.py

refac: modernize type annotations (PEP 604 / PEP 585)

2026-05-12 17:10:15 +09:00

tools.py

refac

2026-05-21 14:01:57 +04:00

users.py

refac

2026-05-21 15:29:49 +04:00

utils.py

refac

2026-05-21 16:25:25 +04:00