fix(api,frontend): isolate active share files and allowlist link schemes

backend/src/utils/files.py

@@ -67,6 +67,13 @@ _GENERIC_MIMES = {
 
 _INLINE_MIME_PREFIXES = ("image/", "video/", "audio/", "text/")
 _INLINE_MIMES = {"application/pdf", "application/json"}
+_ACTIVE_MIMES = {
+    "text/html",
+    "application/xhtml+xml",
+    "image/svg+xml",
+    "text/xml",
+    "application/xml",
+}
 
 _PREVIEW_AGENTS = (
     "telegrambot",
@@ -202,6 +209,10 @@ def is_inline_mime(mime: str | None) -> bool:
     return mime in _INLINE_MIMES or mime.startswith(_INLINE_MIME_PREFIXES)
 
 
+def is_active_mime(mime: str | None) -> bool:
+    return bool(mime) and mime.split(";", 1)[0].strip().lower() in _ACTIVE_MIMES
+
+
 def content_disposition(file_name: str, *, attachment: bool) -> str:
     kind = "attachment" if attachment else "inline"
     ascii_name = file_name.encode("ascii", "replace").decode("ascii").replace('"', "_")