Add CSP protection on uploaded files (#1304)

Add CSP
huggingface · Jul 1, 2024 · f3f6a8b · f3f6a8b
1 parent 04707e4
commit f3f6a8b
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 0 deletions.
diff --git a/src/routes/conversation/[id]/output/[sha256]/+server.ts b/src/routes/conversation/[id]/output/[sha256]/+server.ts
@@ -44,6 +44,8 @@ export const GET: RequestHandler = async ({ locals, params }) => {
 	return new Response(Buffer.from(value, "base64"), {
 		headers: {
 			"Content-Type": mime ?? "application/octet-stream",
+			"Content-Security-Policy":
+				"default-src 'none'; script-src 'none'; style-src 'none'; sandbox;",
 		},
 	});
 };
diff --git a/src/routes/settings/(nav)/assistants/[assistantId]/avatar.jpg/+server.ts b/src/routes/settings/(nav)/assistants/[assistantId]/avatar.jpg/+server.ts
@@ -37,6 +37,8 @@ export const GET: RequestHandler = async ({ params }) => {
 	return new Response(content, {
 		headers: {
 			"Content-Type": "image/jpeg",
+			"Content-Security-Policy":
+				"default-src 'none'; script-src 'none'; style-src 'none'; sandbox;",
 		},
 	});
 };