fix: security & privacy (rate limiter fix, csrf session cookie, logout on server, drafts stale token passw, login timing, password over 72b, JWT_SECRET complexity, SMTP TLS, CSV export neutralised, fonts bundled, upload metadata, hourly cleanup job, privacy.md report)

internal/infrastructure/useCases/CreateImage.go

@@ -29,10 +29,11 @@ type CreateImageUseCase struct {
 	imageRepository image.Repository
 	storage         image.Storage
 	recorder        audit.Recorder
+	stripper        image.MetadataStripper
 }
 
-func NewCreateImageUseCase(imageRepository image.Repository, storage image.Storage, recorder audit.Recorder) *CreateImageUseCase {
-	return &CreateImageUseCase{imageRepository, storage, recorder}
+func NewCreateImageUseCase(imageRepository image.Repository, storage image.Storage, recorder audit.Recorder, stripper image.MetadataStripper) *CreateImageUseCase {
+	return &CreateImageUseCase{imageRepository, storage, recorder, stripper}
 }
 
 func (g *CreateImageUseCase) CreateImage(ctx context.Context, input image.ImageInput) (image.Image, error) {
@@ -74,6 +75,11 @@ func (g *CreateImageUseCase) create(input image.ImageInput) (image.Image, error)
 		return image.Image{}, err
 	}
 
+	data, err = g.stripper.Strip(input.ContentType, data)
+	if err != nil {
+		return image.Image{}, err
+	}
+
 	checksum := sha256.Sum256(data)
 	storedName, err := g.storage.Put(input.ContentType, bytes.NewReader(data))
 	if err != nil {