zopefoundation / Zope / 6224812692 / 1

81%

master: 82%

push

github

Allow only some image types to be displayed inline.

Force download for others, especially SVG images.  By default we use a list of allowed types.
You can switch a to a list of denied types by setting OS environment variable
``OFS_IMAGE_USE_DENYLIST=1``.  This change only affects direct URL access.
``<img src="image.svg" />`` works the same as before.

See security advisory:
https://github.com/zopefoundation/Zope/security/advisories/GHSA-wm8q-9975-xh5v

4332 of 7070 branches covered (0.0%)

Branch coverage included in aggregate %.

27197 of 31792 relevant lines covered (85.55%)

0.86 hits per line