On: NSO Group iMessage Zero-Click Exploit Captured in ...

[willis936]

Discourse avatars point to a page with a .png extension regardless of what the actual file is (jpg, gif, or svg). Parsing file headers should not be a dangerous operation and in my opinion is the right thing to do.