Add CSP protection on uploaded files (#1304)

src/routes/conversation/[id]/output/[sha256]/+server.ts

@@ -44,6 +44,8 @@ export const GET: RequestHandler = async ({ locals, params }) => {
 	return new Response(Buffer.from(value, "base64"), {
 		headers: {
 			"Content-Type": mime ?? "application/octet-stream",
+			"Content-Security-Policy":
+				"default-src 'none'; script-src 'none'; style-src 'none'; sandbox;",
 		},
 	});
 };

src/routes/settings/(nav)/assistants/[assistantId]/avatar.jpg/+server.ts

@@ -37,6 +37,8 @@ export const GET: RequestHandler = async ({ params }) => {
 	return new Response(content, {
 		headers: {
 			"Content-Type": "image/jpeg",
+			"Content-Security-Policy":
+				"default-src 'none'; script-src 'none'; style-src 'none'; sandbox;",
 		},
 	});
 };