Drop the script-carrier blocklist: any file type (html, exe, svg, ...)
may be attached now, with safety from enforced downloads instead of
type filtering, verified twice:
- the attachment chip anchor carries a download attribute (already),
- the link is /_f/{name}/{original-filename}, a new file-store route
that answers content-disposition: attachment naming the original
file (ASCII-safe fallback + RFC 5987 UTF-8 form). The filename rides
in the URL itself — no filename registry in the database.
Close the residual gap on the plain /_f/{name} route: a stored file
whose mime executes script in origin (html/xml/svg/js) is forced to
download there too, so stripping the filename segment off an
attachment URL cannot turn it into an in-origin page. All /_f/
responses now carry x-content-type-options: nosniff. Subresource
fetches (<img>, favicons) ignore Content-Disposition, so inline
images and icons are unaffected.
Undecodable fake images (store_image falls back to as-is storage) now
attach as files instead of being marked inline images.
LeoVasanko
95554b4165