Oneric 066d5b48ed Fix Content-Type sanitisation for emoji and local uploads ... This was accidentally broken in c8e0f7848b due to a one-letter mistake in the plug option name and an absence of tests. Therefore it was once again possible to serve e.g. Javascript or CSS payloads via uploads and emoji. However due to other protections it was still NOT possible for anyone to serve any payload with an ActivityPub Content-Type. With the CSP policy hardening from previous JS payload exloits predating the Content-Type sanitisation, there is currently no known way of abusing this weakened Content-Type sanitisation, but should be fixed regardless. This commit fixes the option name and adds tests to ensure such a regression doesn't occur again in the future. Reported-by: Lain Soykaf <lain@lain.com>		2025-03-10 19:45:26 +01:00
..
content_type_sanitisation_template.ex	Fix Content-Type sanitisation for emoji and local uploads	2025-03-10 19:45:26 +01:00