Add CSP to local web UI forbidding JavaScript eval()

2026-03-18 21:04:50 +01:00
parent 238e3f9529
commit 99e9b7ec56
5 changed files with 34 additions and 14 deletions
--- a/radicale/httputils.py
+++ b/radicale/httputils.py
@@ -198,7 +198,10 @@ def _serve_traversable(
        return NOT_FOUND
    content_type = MIMETYPES.get(
        os.path.splitext(traversable.name)[1].lower(), FALLBACK_MIMETYPE)
-    headers = {"Content-Type": content_type}
+    headers = {
+        "Content-Type": content_type,
+        "Content-Security-Policy": "default-src 'self'; object-src 'none'"
+    }
    if isinstance(traversable, pathlib.Path):
        headers["Last-Modified"] = time.strftime(
            "%a, %d %b %Y %H:%M:%S GMT",