From a0abd167dccfb9b4aaea04b7d5d6f98c4098f781 Mon Sep 17 00:00:00 2001
From: Shivam Mishra <scm.mymail@gmail.com>
Date: Thu, 26 Mar 2026 09:57:02 +0530
Subject: [PATCH] chore: don't allow pdf inline

---
 config/initializers/active_storage.rb | 15 +++++++++++++++
 1 file changed, 15 insertions(+)
 create mode 100644 config/initializers/active_storage.rb

diff --git a/config/initializers/active_storage.rb b/config/initializers/active_storage.rb
new file mode 100644
index 000000000..d2581f78a
--- /dev/null
+++ b/config/initializers/active_storage.rb
@@ -0,0 +1,15 @@
+# Restrict content types served inline to prevent XSS via uploaded files.
+# PDFs with embedded JavaScript can execute in-browser when served with
+# Content-Disposition: inline. Force them to download instead.
+Rails.application.config.active_storage.content_types_allowed_inline = %w[
+  image/png
+  image/gif
+  image/jpeg
+  image/tiff
+  image/vnd.adobe.photoshop
+  image/vnd.microsoft.icon
+  image/webp
+  image/avif
+  image/heic
+  image/heif
+]