S4 stored-XSS + S9 upload-size DoS from the #197 cold API review.
The artwork path trusted client-supplied content types at both ends: upload
validated only the declared multipart Content-Type (never decoded the bytes),
and serving reflected a client `?contentType=` straight into the response
Content-Type on unauthenticated GET sinks (/iptv/logos, /artwork/watermarks).
Chain: upload <script> bytes as image/png -> GET ...?contentType=text/html
serves them as HTML in-origin. nosniff (#279) does not help because the server
explicitly declares text/html.
- Upload: derive the content type from the bytes via SkiaSharp SKCodec
(header-only, no decode -> no decompression-bomb path); reject non-images 422.
New ErsatzTV.Core/Images/ImageContentTypes as the single allow-list source.
Dropped the untrusted declared Content-Type from the UploadArtwork command.
- Serve: removed the ?contentType= reflection structurally -- dropped ContentType
from GetCachedImagePath and the [FromQuery] binding on GetImage/GetWatermark;
the handler always sniffs the file, defaulting application/octet-stream.
ArtworkContentTypeModel.UrlWithContentType is now the bare path; SPA previews
no longer append the query.
- Defense-in-depth: channel-logo / watermark {path, contentType} DTOs run through
ArtworkContentTypeModel.Sanitized(), blanking non-allow-listed types on write.
- S9: Kestrel MaxRequestBodySize from ETV_MAXIMUM_UPLOAD_MB rejects oversized
bodies during read (controller file.Length check kept as friendly-error backstop).
Both serve sinks are IgnoreApi, so no OpenAPI change. Tests: byte-sniff accept/
reject, Sanitized() allow-list, Location no longer carries ?contentType=.
Docs: api-conventions §4a + decisions.md 2026-07-12.
Refs #283#197#66
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* handle artwork timeouts so they aren't reported
* catch some more cancellation errors
* add free space validation on startup
* add downgrade health check
* update dependencies
* fix validation in new form layout
* pin mediatr to last oss version
* update dependencies
* cleanup code in core
* cleanup code in ffmpeg
* cleanup code in infra
* cleanup code in scanner
* cleanup code in application
* cleanup main code
* cleanup test code
* solution-wide code cleanup
* start moving local scans to separate process
* send progress updates to main process
* move scanners and tests
* simplify dependencies; sync search index
* commit search index more often when scanning
* support forced scan and cancellation
* use scanner process for plex libraries
* update changelog
* update dockerfiles
* fix search index for local folder scanning
* rework plex scanners
* rework scanner handlers
* emby works again
* sync jellyfin
* cleanup
* update build
* update changelog
* remove scanner dependency in pr and artifacts workflows
* fix mac sed syntax
* fix pr build
* initial work on maintaining playout state
* debugging wip
* fix refresh playout logic
* fix failing test
* more fixes
* update changelog
* comment out some debug logs
* comment out more logs
* starting database redesign
* set season and episode numbers
* use datetimes in db (utc); update movie metadata
* get movie cards from new table
* copy show/episode metadata
* remove old movie metadata type
* rename new movie metadata type
* code cleanup
* start to remove old television classes
* remove old television tables from database
* fix playout building
* fix collection views
* fix show/season views
* clean up movie metadata table
* fix scanner tests
* add libraries ui
* code cleanup
* fix movie scanning/metadata
* add library scan button to ui
* delete library path from ui
* temp disable movie scanning
* remove orphan media items and prevent duplicate paths
* attach artwork to metadata
* fix split show/season display
* fix television artwork
* store year distinct from release date
* fix collections ui
* code cleanup
* add library paths from ui
* fix adding to collections from ui
* fix schedule items loading
* schedule editing works again
* remove some todos
* more cleanup
* fix unit tests
* fix episode sorting
* fix deleting show library paths
* remove unused class
* fix playout list in ui
* fix log viewer
* start to use version/file instead of statistics
* clean up old columns
* fix playout display (time zone)
* fix playback
* fix channel guide time zone
* cascade more deletes
* fix compiler warnings
* fix adding new seasons
* use artwork for channel logo
* clean cache folder on startup (move channel logos, delete everything else)
* log database migration
* update homepage docs for libraries
* fix adding new channel with logo
* fix episode numbers in epg
* fix yml formatting
* test build action
* move ci workflow
* fix unit tests from dotnet test command
* add release workflow
* try another matrix syntax
* fix path to csproj
* fix target framework
* more release fixes
* port fixes for running outside of docker
timothyandClaude Opus 4.8