Fix XSS: Stenghten CSP rules on static file uploads (#4629)

btcpayserver · Feb 13, 2023 · dffa6ac · dffa6ac
1 parent b5abcd5
commit dffa6ac
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/BTCPayServer/Storage/StorageExtensions.cs b/BTCPayServer/Storage/StorageExtensions.cs
@@ -75,7 +75,7 @@ private static Action<StaticFileResponseContext> HandleStaticFileResponse()
                 {
                     context.Context.Response.Headers["Content-Disposition"] = "attachment";
                 }
-                context.Context.Response.Headers["Content-Security-Policy"] = "script-src 'self'";
+                context.Context.Response.Headers["Content-Security-Policy"] = "script-src ;";
             };
         }
     }