fix: correct Content-Type for content-detected SVG responses

When looksLikeSvg detects SVG content under a non-SVG MIME type,
set Content-Type to image/svg+xml so browsers render correctly
with X-Content-Type-Options: nosniff.
This commit is contained in:
Thomas Camlong committed 2026-08-07 21:25:07 +02:00
1 parent e836d07d4c
commit 90d9a50227
1 file changed
+1 -1
@@ -32,7 +32,7 @@ export async function GET(_req: NextRequest, props: { params: Promise<{ id: stri
}
const headers = new Headers();
headers.set("Content-Type", image.contentType);
headers.set("Content-Type", isSvgContent ? "image/svg+xml" : image.contentType);
headers.set("Content-Length", content.length.toString());
headers.set("Content-Security-Policy", "default-src 'none'; style-src 'unsafe-inline'; sandbox");
headers.set("X-Content-Type-Options", "nosniff");