From bc77440b301ac8780698be91dff1ac33b7cee850 Mon Sep 17 00:00:00 2001 From: Joe Chen Date: Tue, 3 May 2022 17:51:28 +0800 Subject: [PATCH] attachment: set CSP header in the serving endpoint (#6926) --- internal/cmd/web.go | 1 + 1 file changed, 1 insertion(+) diff --git a/internal/cmd/web.go b/internal/cmd/web.go index 09c173f40c..6a64f26ba2 100644 --- a/internal/cmd/web.go +++ b/internal/cmd/web.go @@ -314,6 +314,7 @@ func runWeb(c *cli.Context) error { } defer fr.Close() + c.Header().Set("Content-Security-Policy", "default-src 'none'; style-src 'unsafe-inline'; sandbox") c.Header().Set("Cache-Control", "public,max-age=86400") c.Header().Set("Content-Disposition", fmt.Sprintf(`inline; filename="%s"`, attach.Name))