GHSA-9w8w-34vr-65j2 Open raw javadoc resources in sandbox

dzikoysk · May 3, 2024 · d11609f · d11609f
1 parent 60a21af
commit d11609f
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/...silite-backend/src/main/kotlin/com/reposilite/javadocs/infrastructure/JavadocEndpoints.kt b/...silite-backend/src/main/kotlin/com/reposilite/javadocs/infrastructure/JavadocEndpoints.kt
@@ -24,6 +24,7 @@ import com.reposilite.shared.extensions.encoding
 import com.reposilite.storage.api.toLocation
 import com.reposilite.web.api.ReposiliteRoute
 import io.javalin.community.routing.Route.GET
+import io.javalin.http.Header
 
 internal class JavadocEndpoints(javadoc: JavadocFacade) : MavenRoutes(javadoc.mavenFacade) {
 
@@ -51,7 +52,7 @@ internal class JavadocEndpoints(javadoc: JavadocFacade) : MavenRoutes(javadoc.ma
                 requireRepository { repository ->
                     response = JavadocRawRequest(this?.identifier, repository, gav, requireParameter("resource").toLocation())
                         .let { javadoc.findRawJavadocResource(it) }
-                        .peek { ctx.encoding(Charsets.UTF_8).contentType(it.contentType) }
+                        .peek { ctx.encoding(Charsets.UTF_8).contentType(it.contentType).header(Header.CONTENT_SECURITY_POLICY, "sandbox") }
                         .map { it.content }
                 }
             }