From 22e883c6d98a02f2d6ee64ab56a99152ba668d68 Mon Sep 17 00:00:00 2001
From: xfy <i@rua.plus>
Date: Thu, 18 Jun 2026 13:36:39 +0800
Subject: [PATCH] fix(image): add X-Content-Type-Options: nosniff to all image
 responses
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

304 与 200 两个分支都附加 nosniff，防止浏览器对 content-type 错配的图片字节
做 MIME sniff（M2）。配合原始文件分支按扩展名决定 content-type 的行为做纵深防御。
---
 src/api/image.rs | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/src/api/image.rs b/src/api/image.rs
index fc927c6..3ff8a55 100644
--- a/src/api/image.rs
+++ b/src/api/image.rs
@@ -206,6 +206,11 @@ fn image_response(
                     (header::ETAG, HeaderValue::from_str(&etag).unwrap()),
                     (header::CACHE_CONTROL, HeaderValue::from_static(cache_control)),
                     (header::CONTENT_TYPE, content_type),
+                    // nosniff 防止浏览器对 content-type 错配的图片字节做 MIME sniff（M2）。
+                    (
+                        header::X_CONTENT_TYPE_OPTIONS,
+                        HeaderValue::from_static("nosniff"),
+                    ),
                 ],
             )
                 .into_response();
@@ -218,6 +223,10 @@ fn image_response(
             (header::CONTENT_TYPE, content_type),
             (header::CACHE_CONTROL, HeaderValue::from_static(cache_control)),
             (header::ETAG, HeaderValue::from_str(&etag).unwrap()),
+            (
+                header::X_CONTENT_TYPE_OPTIONS,
+                HeaderValue::from_static("nosniff"),
+            ),
         ],
         data,
     )