Gregor Klevze
037b176892
Relax payload scanner for XML/SVG by passing content-type into checks Skip JS-style eval() detection when content-type is XML/SVG Pass request Content-Type through sniff_file_for_php_payload() and raw-body checks Add common XML/SVG content-types to allowlist.json Add repository .gitignore (ignore logs, quarantine/, state/, env, vendor, IDE files)
23 lines
416 B
JSON
23 lines
416 B
JSON
{
|
|
"uris": [
|
|
"/api/uploads/avatars",
|
|
"/api/v1/avatars",
|
|
"/user/avatar",
|
|
"/media/upload",
|
|
"/api/media",
|
|
"/api/uploads",
|
|
"/api/v1/uploads",
|
|
"/attachments/upload",
|
|
"/upload",
|
|
"#^/internal/webhook#",
|
|
"#/hooks/(github|gitlab|stripe|slack)#",
|
|
"/services/avatars",
|
|
"/api/profile/photo"
|
|
],
|
|
"ctypes": [
|
|
"image/svg+xml",
|
|
"application/xml",
|
|
"text/xml"
|
|
]
|
|
}
|