Restrict hotlink mimeType to image/* and harden image responses.

2026-10-26 23:06:23 +01:00
parent 5db90f02c5
commit bf36b1d2aa
6 changed files with 82 additions and 3 deletions
@@ -1,4 +1,4 @@
-import { Controller, Get, Param, StreamableFile } from '@nestjs/common';
+import { Controller, Get, Header, Param, StreamableFile } from '@nestjs/common';
 import { HotlinkImageParamsDto } from '../dto/HotlinkImageParamsDto';
 import { UploadService } from '../services/UploadService';

@@ -7,6 +7,9 @@ export class HotlinkImageController {
    constructor(private readonly uploadService: UploadService) {}

    @Get(':id/:secret')
+    @Header('X-Content-Type-Options', 'nosniff')
+    @Header('Content-Security-Policy', 'sandbox')
+    @Header('Referrer-Policy', 'no-referrer')
    async getImage(@Param() params: HotlinkImageParamsDto): Promise<StreamableFile> {
        const { body, mimeType } = await this.uploadService.getHotlinkImage(params.id, params.secret);