Fix XSS on uploaded files to the file storage

btcpayserver · Jan 26, 2023 · d4e464a · d4e464a
1 parent 438dcc4
commit d4e464a
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/BTCPayServer/Storage/StorageExtensions.cs b/BTCPayServer/Storage/StorageExtensions.cs
@@ -75,6 +75,7 @@ private static Action<StaticFileResponseContext> HandleStaticFileResponse()
                 {
                     context.Context.Response.Headers["Content-Disposition"] = "attachment";
                 }
+                context.Context.Response.Headers["Content-Security-Policy"] = "script-src 'self'";
             };
         }
     }