asmhatreandClaude Sonnet 5.5
aa8b1604ed
Co-Authored-By: Claude Sonnet 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_017ic4b7rnC7jppGGdHGESvy
8 lines
389 B
Plaintext
8 lines
389 B
Plaintext
# Sniff + decode does not catch bytes after the image
|
|
|
|
input : valid 16x16 PNG followed by 25 bytes of <script>
|
|
ImageVerifier : ACCEPT (image/png)
|
|
why it is still OK: the object is stored as Content-Type image/png with
|
|
Content-Disposition: attachment, so a browser will not run it as HTML.
|
|
The check is the header, not the sniffing.
|