Skip to content

1.7.0

Latest
Latest

Choose a tag to compare

View all tags
@lisajulia lisajulia released this 20 Aug 18:24
· 11 commits to main since this release
1.7.0
f4f9956
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Added

  • Added support for single (inline) attachments via the Attachment type. (#768)
  • Added top-level Attachments aspect to allow usage without sap.attachments namespace (#806), i.e., using {Attachments} from 'com.sap.cds/cds-feature-attachments'.

Security

  • Attachment content is now served with Content-Disposition: attachment by default (previously inline) to mitigate stored XSS (CWE-79) via user-uploaded SVG/HTML payloads (cds-calesi #1263). Applications that require inline previews can opt in by annotating content in their own CDS model — see the "Content Disposition" section in the README. It is recommended to combine this with @Core.AcceptableMediaTypes restricting inline content to non-scriptable types (e.g. image/jpeg, image/png, application/pdf).

Full Changelog: 1.6.0...1.7.0

Assets 2
Loading