xwiki/xwiki-platform — pull request #140 by tdelafosse (2013-08-05 18:22:56+00:00)
Title: XWiki-9366 : XSS via File Upload

As discussed in the mailing list, this feature is configurable : you can either define a whitelist or a blacklist of mimetypes that can / cannot be displayed inline.