@tesaguri What do you think about the recommendations given in FEP-fe34? ^
GHSA-jhrq-qvrm-qr36 is written as if Mastodon is guilty, because it didn't check Content-Type header. However, I think we should blame the servers that failed to validate uploaded documents, because it is their actors get impersonated.