Stefan Prodan 550ee9f7b9 Fix stored XSS in /store endpoint (CVE-2025-70849) ...

Set Content-Type to application/octet-stream in storeReadHandler
to prevent Go's content sniffing from serving HTML payloads as
text/html. Add X-Content-Type-Options: nosniff to prevent browsers
from overriding Content-Type via MIME sniffing, and
Content-Security-Policy: default-src 'none' to block script
execution as defense-in-depth.

Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>

2026-03-14 14:40:55 +02:00

..

api

Fix stored XSS in /store endpoint (CVE-2025-70849)

2026-03-14 14:40:55 +02:00

fscache

Update dependencies

2023-02-03 11:42:17 +02:00

signals

add comment on sleep during graceful shutdown

2023-11-15 18:47:52 +08:00

version

Release 6.11.0

2026-03-06 21:43:50 +02:00