xfy 22e883c6d9 fix(image): add X-Content-Type-Options: nosniff to all image responses ...

304 与 200 两个分支都附加 nosniff，防止浏览器对 content-type 错配的图片字节
做 MIME sniff（M2）。配合原始文件分支按扩展名决定 content-type 的行为做纵深防御。

2026-06-18 13:36:39 +08:00

..

comments

fix(comments): make duplicate-check atomic with transaction; index content_hash

2026-06-18 13:31:37 +08:00

posts

fix(posts): wrap rebuild_content_html in single transaction

2026-06-18 13:32:55 +08:00

auth.rs

fix(auth): run dummy Argon2 verify for non-existent users to prevent timing enumeration

2026-06-18 13:29:55 +08:00

csrf.rs

feat(security): add Origin-based CSRF protection for write endpoints

2026-06-18 13:22:59 +08:00

error.rs

security: fix critical issues from repository review

2026-06-17 10:34:14 +08:00

image.rs

fix(image): add X-Content-Type-Options: nosniff to all image responses

2026-06-18 13:36:39 +08:00

markdown.rs

refactor(markdown): unify parser options across TOC and HTML passes

2026-06-18 11:16:58 +08:00

mod.rs

feat(security): add Origin-based CSRF protection for write endpoints

2026-06-18 13:22:59 +08:00

rate_limit.rs

perf(rate-limit): use lenient bucket when client IP is unknown

2026-06-18 11:28:06 +08:00

sanitizer.rs

perf(sanitizer): staticize allowlists with LazyLock to avoid per-call allocation

2026-06-18 11:23:30 +08:00

settings.rs

refactor: 清理 clippy 提示（unwrap_or 与宏 deprecated 放行）

2026-06-16 12:40:43 +08:00

slug.rs

security: fix critical issues from repository review

2026-06-17 10:34:14 +08:00

upload.rs

perf(upload): offload GIF/WebP raw image validation to spawn_blocking

2026-06-18 11:19:34 +08:00