chore: don't allow pdf inline

2026-03-26 09:57:02 +05:30
parent 775b73d1f9
commit a0abd167dc
1 changed files with 15 additions and 0 deletions
@@ -0,0 +1,15 @@
+# Restrict content types served inline to prevent XSS via uploaded files.
+# PDFs with embedded JavaScript can execute in-browser when served with
+# Content-Disposition: inline. Force them to download instead.
+Rails.application.config.active_storage.content_types_allowed_inline = %w[
+  image/png
+  image/gif
+  image/jpeg
+  image/tiff
+  image/vnd.adobe.photoshop
+  image/vnd.microsoft.icon
+  image/webp
+  image/avif
+  image/heic
+  image/heif
+]