isaaccladandClaude Opus 4.8
f48592077f
Deploy Ladill Merchant / deploy (push) Successful in 24s
SVG can embed JavaScript and would run as stored XSS when served inline on a public storefront page, and we have no SVG sanitizer. Allow only raster formats: - item_images validation: image rule (permits SVG) -> mimes:jpeg,jpg,png,gif,webp - QrCodeManagerService: reject image/svg+xml / .svg(z) in brand-image and item-image storage (defense in depth, since those only checked the image/* prefix) - file pickers: accept raster mimes only Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>