Restrict hotlink mimeType to image/* and harden image responses.

backend/src/modules/upload/controllers/HotlinkImageController.ts

@@ -1,4 +1,4 @@
-import { Controller, Get, Param, StreamableFile } from '@nestjs/common';
+import { Controller, Get, Header, Param, StreamableFile } from '@nestjs/common';
 import { HotlinkImageParamsDto } from '../dto/HotlinkImageParamsDto';
 import { UploadService } from '../services/UploadService';
 
@@ -7,6 +7,9 @@ export class HotlinkImageController {
     constructor(private readonly uploadService: UploadService) {}
 
     @Get(':id/:secret')
+    @Header('X-Content-Type-Options', 'nosniff')
+    @Header('Content-Security-Policy', 'sandbox')
+    @Header('Referrer-Policy', 'no-referrer')
     async getImage(@Param() params: HotlinkImageParamsDto): Promise<StreamableFile> {
         const { body, mimeType } = await this.uploadService.getHotlinkImage(params.id, params.secret);
 

backend/src/modules/upload/dto/CreateHotlinkUploadDto.ts

@@ -1,9 +1,10 @@
-import { IsMimeType, IsNotEmpty, IsString } from 'class-validator';
+import { IsNotEmpty, IsString } from 'class-validator';
+import { IsImageMimeType } from '../../../validation/decorators/isImageMimeType';
 import { UploadCiphertextOptionsDto } from './UploadCiphertextOptionsDto';
 
 export class CreateHotlinkUploadDto extends UploadCiphertextOptionsDto {
     @IsNotEmpty()
     @IsString()
-    @IsMimeType()
+    @IsImageMimeType()
     mimeType: string;
 }