Add hardened headers to user-uploaded files (#25756)

2023-07-06 14:31:37 +02:00
parent fac2c9eb7d
commit 9b6c0cac7d
2 changed files with 7 additions and 0 deletions
--- a/lib/public_file_server_middleware.rb
+++ b/lib/public_file_server_middleware.rb
@@ -32,6 +32,11 @@ class PublicFileServerMiddleware
      end
    end

+    # Override the default CSP header set by the CSP middleware
+    headers['Content-Security-Policy'] = "default-src 'none'; form-action 'none'" if request_path.start_with?(paperclip_root_url)
+
+    headers['X-Content-Type-Options'] = 'nosniff'
+
    [status, headers, response]
  end