-
-
Notifications
You must be signed in to change notification settings - Fork 297
Closed
Description
Describe the bug
https://npmx.dev/package/element-plus#user-content-contributors
Possibly related:
npmx.dev/server/api/registry/image-proxy/index.get.ts
Lines 159 to 167 in 85ac3d7
| // Only allow raster/vector image content types, but block SVG to prevent | |
| // embedded JavaScript execution (SVGs can contain <script> tags, event handlers, etc.) | |
| if (!contentType.startsWith('image/') || contentType.includes('svg')) { | |
| await response.body?.cancel() | |
| throw createError({ | |
| statusCode: 400, | |
| message: 'URL does not point to an allowed image type.', | |
| }) | |
| } |
Additional context
No response
Logs
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
No labels