Rotimi Best
900f5ec129
fix: critical SVG XSS vulnerability in file uploads
- Add comprehensive file type validation to prevent SVG uploads
- Update upload widgets to restrict file types at input level
- Enhanced HTML sanitization to block SVG tags and data URLs
- Create centralized file validation utilities with shared constants
- Add client-side and server-side protection against malicious uploads
Security Impact:
- Prevents stored XSS attacks through malicious SVG profile uploads
- Blocks execution of JavaScript embedded in SVG files
- Enforces whitelist of safe image formats (JPEG, PNG, GIF, WebP)
- Provides defense-in-depth protection across all upload components
Fixes reported vulnerability in profile image upload functionality.
2025-12-03 11:25:00 +01:00
..
2025-12-03 11:25:00 +01:00
2024-12-14 03:40:47 +01:00
2024-11-12 02:18:51 +01:00
2023-11-25 21:56:02 +00:00
2023-11-25 21:56:02 +00:00
2025-09-10 17:24:35 +01:00
2023-12-03 15:56:15 +03:00
2023-11-25 21:56:02 +00:00
2025-09-28 20:57:45 +01:00
2023-11-25 21:56:02 +00:00
2024-10-07 01:36:07 +01:00
2024-10-19 20:14:53 +01:00
2024-02-02 08:18:26 +01:00
2024-11-13 03:49:47 +01:00
