Address @diracdeltas feedback on #1714

webtorrent · feross · Aug 27, 2019 · Aug 27, 2019 · Aug 27, 2019 · Aug 27, 2019
commit 9029557ca3d22faef67315f8ed33df295ce6d59e
diff --git a/lib/server.js b/lib/server.js
@@ -88,7 +88,7 @@ function Server (torrent, opts = {}) {
     res.setHeader('X-Content-Type-Options', 'nosniff')
 
     // Defense-in-depth: Set a strict Content Security Policy to mitigate XSS
-    res.setHeader('Content-Security-Policy', "base-uri 'none'; default-src 'none'; frame-ancestors 'none'; object-src 'none';")
+    res.setHeader('Content-Security-Policy', "base-uri 'none'; default-src 'none'; frame-ancestors 'none'; form-action 'none';")
 
     if (pathname === '/favicon.ico') {
       return serve404Page()