Print the raw-content headers with the rest

1 file changed, 7 insertions, 0 deletions

diff --git a/source/ui-shared.c b/source/ui-shared.c
index 74c1c48..110dd91 100644
--- a/source/ui-shared.c
+++ b/source/ui-shared.c
@@ -1103,6 +1103,13 @@ void cgit_print_http_headers(void)
 		html_header_arg_in_quotes(ctx.page.filename);
 		html("\"\n");
 	}
+	// An untrusted page serves repository bytes verbatim, so the browser is
+	// told not to guess a type of its own from them and not to load
+	// anything they reference.
+	if (ctx.page.untrusted) {
+		html("X-Content-Type-Options: nosniff\n");
+		html("Content-Security-Policy: default-src 'none'\n");
+	}
 	if (!ctx.env.authenticated)
 		html("Cache-Control: no-cache, no-store\n");
 	html("\n");