Classic298andClaude Opus 4.7 f5f4b58958 fix: harden model profile image against SVG stored XSS (#25060) ...

ModelMeta.profile_image_url now runs validate_profile_image_url, rejecting SVG/script data URIs (matching UserUpdateForm and ChannelWebhookForm). The /model/profile/image endpoint enforces the PROFILE_IMAGE_ALLOWED_MIME_TYPES allowlist and sets X-Content-Type-Options: nosniff, so an SVG data URI can no longer be served inline on-origin. Closes the fourth profile-image XSS sink missed by the user and webhook fixes.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-28 17:41:55 -05:00

..

access_grants.py

refac: modernize type annotations (PEP 604 / PEP 585)

2026-05-12 17:10:15 +09:00

auths.py

refac

2026-05-21 15:29:49 +04:00

automations.py

refac: modernize type annotations (PEP 604 / PEP 585)

2026-05-12 17:10:15 +09:00

calendar.py

refac: modernize type annotations (PEP 604 / PEP 585)

2026-05-12 17:10:15 +09:00

channels.py

refac: modernize type annotations (PEP 604 / PEP 585)

2026-05-12 17:10:15 +09:00

chat_messages.py

refac

2026-05-19 20:37:53 +04:00

chats.py

refac

2026-05-21 17:48:28 +04:00

feedbacks.py

refac: modernize type annotations (PEP 604 / PEP 585)

2026-05-12 17:10:15 +09:00

files.py

refac

2026-05-21 15:29:49 +04:00

folders.py

refac: modernize type annotations (PEP 604 / PEP 585)

2026-05-12 17:10:15 +09:00

functions.py

refac

2026-05-21 15:29:49 +04:00

groups.py

refac: modernize type annotations (PEP 604 / PEP 585)

2026-05-12 17:10:15 +09:00

knowledge.py

refac

2026-05-28 17:24:33 -05:00

memories.py

refac

2026-05-21 15:29:49 +04:00

messages.py

refac: modernize type annotations (PEP 604 / PEP 585)

2026-05-12 17:10:15 +09:00

models.py

fix: harden model profile image against SVG stored XSS (#25060)

2026-05-28 17:41:55 -05:00

notes.py

refac

2026-05-14 01:49:34 +09:00

oauth_sessions.py

refac: modernize type annotations (PEP 604 / PEP 585)

2026-05-12 17:10:15 +09:00

prompt_history.py

refac: modernize type annotations (PEP 604 / PEP 585)

2026-05-12 17:10:15 +09:00

prompts.py

fix(prompts): resolve undefined session variable in _get_access_grants and _to_prompt_model (#25129)

2026-05-28 16:23:25 -05:00

shared_chats.py

refac: modernize type annotations (PEP 604 / PEP 585)

2026-05-12 17:10:15 +09:00

skills.py

refac: modernize type annotations (PEP 604 / PEP 585)

2026-05-12 17:10:15 +09:00

tags.py

refac

2026-05-21 15:29:49 +04:00

tools.py

refac

2026-05-21 15:29:49 +04:00

users.py

refac

2026-05-21 15:29:49 +04:00