From 90d9a5022791788c878ebe3b7acaa4a90f400005 Mon Sep 17 00:00:00 2001 From: Thomas Camlong Date: Fri, 7 Aug 2026 21:25:07 +0200 Subject: [PATCH] fix: correct Content-Type for content-detected SVG responses When looksLikeSvg detects SVG content under a non-SVG MIME type, set Content-Type to image/svg+xml so browsers render correctly with X-Content-Type-Options: nosniff. --- apps/nextjs/src/app/api/user-medias/[id]/route.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apps/nextjs/src/app/api/user-medias/[id]/route.ts b/apps/nextjs/src/app/api/user-medias/[id]/route.ts index ce2aecdb1..30f59adb7 100644 --- a/apps/nextjs/src/app/api/user-medias/[id]/route.ts +++ b/apps/nextjs/src/app/api/user-medias/[id]/route.ts @@ -32,7 +32,7 @@ export async function GET(_req: NextRequest, props: { params: Promise<{ id: stri } const headers = new Headers(); - headers.set("Content-Type", image.contentType); + headers.set("Content-Type", isSvgContent ? "image/svg+xml" : image.contentType); headers.set("Content-Length", content.length.toString()); headers.set("Content-Security-Policy", "default-src 'none'; style-src 'unsafe-inline'; sandbox"); headers.set("X-Content-Type-Options", "nosniff");