sa6anw/hedgedoc-hedgeagent
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

fix(security): increase CSP policy by explicitly sandboxing uploads

Browse Source 
Adding the sandbox attribute tells browsers to apply stricter
restrictions like preventing execution of plugins and scripts.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
This commit is contained in:
Erik Michelson
2026-02-03 21:49:35 +01:00
parent 74daa0e7a1
commit b930fe04ce
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
app.js
View File

@@ -159,7 +159,7 @@ app.use(i18n.init)
// security headers for uploads // security headers for uploads
app.use('/uploads', (req, res, next) => { app.use('/uploads', (req, res, next) => {
res.set('Content-Disposition', 'attachment') res.set('Content-Disposition', 'attachment')
res.set('Content-Security-Policy', "default-src 'none'") res.set('Content-Security-Policy', "default-src 'none'; sandbox")
next() next()
}) })