feat: add PDF URL validation and content type check

[Yukaii]

Companion test script

A bun proxy server that serve xss content https://william957-web.github.io/meow_xss.html

// pdf-proxy.js
const server = Bun.serve({
  port: 5678,
  async fetch(req) {
    // Only handle requests to our proxy endpoint
    const url = new URL(req.url);
    if (url.pathname !== "/proxy-as-pdf.pdf") {
      return new Response("Not Found", { status: 404 });
    }

    try {
      // Fetch the original HTML content
      const response = await fetch("https://william957-web.github.io/meow_xss.html");
      const originalContent = await response.text();

      // Return the HTML content with PDF content type
      return new Response(originalContent, {
        headers: {
          "Content-Type": "application/pdf",
          "Content-Disposition": "inline; filename=document.pdf"
        }
      });
    } catch (error) {
      console.error("Error fetching the content:", error);
      return new Response("Error proxying the content", { status: 500 });
    }
  }
});

console.log(`PDF proxy server running at http://localhost:${server.port}`);

And reverse proxy

caddy reverse-proxy --from local.localhost --to localhost:5678 --internal-certs

And embed with:

{%pdf https://local.localhost/proxy-as-pdf.pdf %}

[Copilot]

Pull Request Overview

This PR adds PDF URL validation and a content type check to improve the reliability of PDF embedding.

• Added an async function isPdfUrl in utils.js to check if a URL returns a PDF Content-Type.
• Updated extra.js to perform both extension and content type checks before embedding a PDF.

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
public/js/utils.js	Added isPdfUrl to fetch HEAD and validate the Content-Type header
public/js/extra.js	Integrated PDF validation logic with both extension and content type checks

[EastSun5566]

LGTM