Linus Rath 0ccb533405 fix: serve sender favicons only as inert raster images ...

`/api/favicon` is unauthenticated and answers on the webmail origin,
and it passed the upstream Content-Type through unchecked. Should the
favicon service ever return `image/svg+xml` or `text/html`, opening
that URL on its own would run script as the webmail. Only raster image
types are served now, with `nosniff` and a sandboxing CSP; anything
else falls back to the transparent placeholder.

2026-09-26 16:24:11 +02:00

..

route.ts

fix: serve sender favicons only as inert raster images

2026-09-26 16:24:11 +02:00