file_storage: ACTIVE_CONTENT_TYPES misses scriptable XML types and malformed content types #545

file_storage.constants.ACTIVE_CONTENT_TYPES decides which uploads are always streamed with the restrictive CSP instead of being served inline/redirected. It misses XML types browsers render as scriptable documents: application/atom+xml, application/rss+xml, application/mathml+xml, text/xsl, application/vnd.wap.xhtml+xml, and in general any *+xml. A malformed value such as text/html, or one with parameters/odd casing may also slip past an exact-match check. With allowed_content_types=None (the default) an uploader controls the stored type.

Fix direction: normalise the media type (lower-case, strip parameters and trailing junk), treat any *+xml and text/xsl as active, or invert to an allow-list of types safe to serve inline. Add tests per type.

Found in the security review of #525 (pre-existing).

https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4