15 lines
705 B
JSON
15 lines
705 B
JSON
{
|
|
"feature_id": "F-095",
|
|
"agent": "security",
|
|
"verdict": "APPROVED",
|
|
"summary": "Remote imports remain authenticated and constrained to public HTTP(S) image resources with redirect, size, MIME, and binary signature checks.",
|
|
"evidence": [
|
|
"Upload route requires authenticated backoffice session before remote fetch",
|
|
"localhost, local hostnames, private IPv4, and private IPv6 destinations are rejected",
|
|
"Only image MIME types supported by the existing upload pipeline are accepted",
|
|
"10MB limit, timeout, limited redirects, and image magic-byte validation are enforced",
|
|
"Remote URL is never stored directly as a product image"
|
|
],
|
|
"timestamp": "2026-08-20T20:05:20Z"
|
|
}
|