Diff options
| author | Bryce Kwon <bryce@brycekwon.com> | |
|---|---|---|
| committer | Bryce Kwon <bryce@brycekwon.com> | |
| commit | ||
| parent | ||
| tree | ||
| download | ||
Print the raw-content headers with the rest
Diffstat (limited to 'source/ui-shared.c')
| -rw-r--r-- | source/ui-shared.c | 7 |
1 file changed, 7 insertions, 0 deletions
diff --git a/source/ui-shared.c b/source/ui-shared.c index 74c1c48..110dd91 100644 --- a/source/ui-shared.c +++ b/source/ui-shared.c @@ -1103,6 +1103,13 @@ void cgit_print_http_headers(void) html_header_arg_in_quotes(ctx.page.filename); html("\"\n"); } + // An untrusted page serves repository bytes verbatim, so the browser is + // told not to guess a type of its own from them and not to load + // anything they reference. + if (ctx.page.untrusted) { + html("X-Content-Type-Options: nosniff\n"); + html("Content-Security-Policy: default-src 'none'\n"); + } if (!ctx.env.authenticated) html("Cache-Control: no-cache, no-store\n"); html("\n"); |