Add hardened headers to user-uploaded files

Signed-off-by: Claire <claire.github-309c@sitedethib.com>

diff --git a/config/application.rb b/config/application.rb
index c252d5a34305066c4b81f0a9b4613b9945893d49..57dd57239b1de7d5b1175ad5108439d3d1c6755c 100644 (file)
--- a/config/application.rb
+++ b/config/application.rb
@@ -160,6 +160,10 @@ module Mastodon
       end
     end
 
+    config.public_file_server.headers = {
+      'X-Content-Type-Options' => 'nosniff',
+    }
+
     # config.paths.add File.join('app', 'api'), glob: File.join('**', '*.rb')
     # config.autoload_paths += Dir[Rails.root.join('app', 'api', '*')]
 

diff --git a/dist/nginx.conf b/dist/nginx.conf
index 7e03343680c6b624de73da23a142fbe81c661b50..cbcf328a6eaee4544fe79ca35c8c83633b85053b 100644 (file)
--- a/dist/nginx.conf
+++ b/dist/nginx.conf
@@ -61,12 +61,15 @@ server {
   location ~ ^/(emoji|packs|system/accounts/avatars|system/media_attachments/files) {
     add_header Cache-Control "public, max-age=31536000, immutable";
     add_header Strict-Transport-Security "max-age=31536000" always;
+    add_header X-Content-Type-Options nosniff;
+    add_header Content-Security-Policy "default-src 'none'; form-action 'none'";
     try_files $uri @proxy;
   }
 
   location /sw.js {
     add_header Cache-Control "public, max-age=0";
     add_header Strict-Transport-Security "max-age=31536000" always;
+    add_header X-Content-Type-Options nosniff;
     try_files $uri @proxy;
   }