fix: enforce content policies using original file types

src/core/AnonymizedFile.ts

@@ -343,7 +343,7 @@ export default class AnonymizedFile {
 
   async anonymizedContent() {
     const anonymizer = this.repository.generateAnonymizeTransformer(
-      this.anonymizedPath
+      await this.originalPath()
     );
     if (!config.STREAMER_ENTRYPOINT) {
       // collect the content locally
@@ -385,7 +385,7 @@ export default class AnonymizedFile {
 
   async send(res: Response): Promise<void> {
     const anonymizer = this.repository.generateAnonymizeTransformer(
-      this.anonymizedPath
+      await this.originalPath()
     );
     // eslint-disable-next-line no-async-promise-executor
     return new Promise<void>(async (resolve, reject) => {

src/core/zipStream.ts

@@ -149,7 +149,7 @@ export async function streamAnonymizedZip(
             entry.path.substring(entry.path.indexOf("/") + 1),
             compiledTerms
           );
-          if (!isEntryAllowed(fileName, opt.contentOptions)) {
+          if (!isEntryAllowed(entry.path, opt.contentOptions)) {
             entry.autodrain();
             return;
           }
@@ -159,7 +159,7 @@ export async function streamAnonymizedZip(
           // isText=false for every file, so the zip ships unanonymized.
           const anonymizer = new AnonymizeTransformer({
             ...opt.anonymizerOptions,
-            filePath: fileName,
+            filePath: entry.path,
           });
           const st = entry.pipe(anonymizer);
           archive.append(st, { name: fileName });