From 87e36a3ecf66e894d0ca6896c42714a92c37c89b Mon Sep 17 00:00:00 2001 From: Harrison Healey Date: Tue, 12 Feb 2019 15:27:17 -0500 Subject: [PATCH] MM-14146 Update CSP for local image proxy (#10277) --- services/imageproxy/local.go | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/services/imageproxy/local.go b/services/imageproxy/local.go index 84425f708e..2e01cc449d 100644 --- a/services/imageproxy/local.go +++ b/services/imageproxy/local.go @@ -71,6 +71,11 @@ func (backend *LocalBackend) GetImage(w http.ResponseWriter, r *http.Request, im return } + w.Header().Set("X-Frame-Options", "deny") + w.Header().Set("X-XSS-Protection", "1; mode=block") + w.Header().Set("X-Content-Type-Options", "nosniff") + w.Header().Set("Content-Security-Policy", "default-src 'none'; img-src data:; style-src 'unsafe-inline'") + backend.impl.ServeHTTP(w, req) }