From 3c30c3975ae9b56664f3049c4b71472c7ef96a62 Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Tue, 18 Aug 2026 19:49:42 -0700 Subject: Print the raw-content headers with the rest --- source/ui-shared.c | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'source/ui-shared.c') diff --git a/source/ui-shared.c b/source/ui-shared.c index 74c1c48..110dd91 100644 --- a/source/ui-shared.c +++ b/source/ui-shared.c @@ -1103,6 +1103,13 @@ void cgit_print_http_headers(void) html_header_arg_in_quotes(ctx.page.filename); html("\"\n"); } + // An untrusted page serves repository bytes verbatim, so the browser is + // told not to guess a type of its own from them and not to load + // anything they reference. + if (ctx.page.untrusted) { + html("X-Content-Type-Options: nosniff\n"); + html("Content-Security-Policy: default-src 'none'\n"); + } if (!ctx.env.authenticated) html("Cache-Control: no-cache, no-store\n"); html("\n"); -- cgit v2.8.0