fix: correct Content-Type for content-detected SVG responses
When looksLikeSvg detects SVG content under a non-SVG MIME type, set Content-Type to image/svg+xml so browsers render correctly with X-Content-Type-Options: nosniff.
This commit is contained in:
1 file changed
+1
-1
@@ -32,7 +32,7 @@ export async function GET(_req: NextRequest, props: { params: Promise<{ id: stri
|
||||
}
|
||||
|
||||
const headers = new Headers();
|
||||
headers.set("Content-Type", image.contentType);
|
||||
headers.set("Content-Type", isSvgContent ? "image/svg+xml" : image.contentType);
|
||||
headers.set("Content-Length", content.length.toString());
|
||||
headers.set("Content-Security-Policy", "default-src 'none'; style-src 'unsafe-inline'; sandbox");
|
||||
headers.set("X-Content-Type-Options", "nosniff");
|
||||
|
||||
Reference in new issue
Block a user