Infrastructure/imageproxy
0
Fork 0
mirror of https://github.com/willnorris/imageproxy.git synced 2024-12-30 22:34:18 -05:00
Code Issues Activity

Set a strict Content-Security-Policy

Browse source
This commit is contained in:
Blake Stoddard 2020-10-16 09:52:54 -04:00 committed by Will Norris
parent 66c549e07b
commit c6206ea30c
1 changed files with 3 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
imageproxy.go
View file

@ -252,6 +252,9 @@ func (p *Proxy) serveImage(w http.ResponseWriter, r *http.Request) {
// Enable CORS for 3rd party applications // Enable CORS for 3rd party applications
w.Header().Set("Access-Control-Allow-Origin", "*") w.Header().Set("Access-Control-Allow-Origin", "*")
// Add a Content-Security-Policy to prevent stored-XSS attacks via SVG files
w.Header().Set("Content-Security-Policy", "script-src 'none'")
w.WriteHeader(resp.StatusCode) w.WriteHeader(resp.StatusCode)
if _, err := io.Copy(w, resp.Body); err != nil { if _, err := io.Copy(w, resp.Body); err != nil {
p.logf("error copying response: %v", err) p.logf("error copying response: %v", err)