Serve downloads with nosniff and a sandbox CSP

main.go

@@ -466,6 +466,14 @@ func handleDownload(w http.ResponseWriter, r *http.Request) {
 	// The extension lookup relies on the system MIME database, which the
 	// Dockerfile provides via the mailcap package.
 	w.Header().Set("Content-Type", detectContentType(filename))
+	// Uploads are anonymous and served back from this origin, so an uploaded
+	// .html or .svg opened inline would otherwise be stored XSS. The sandbox
+	// directive puts the response in an opaque origin with scripting, forms and
+	// top-level navigation disabled; nosniff stops a mislabeled file from being
+	// re-typed into something executable. Both are set before ServeContent so
+	// they apply to its 206, 304 and HEAD responses too.
+	w.Header().Set("X-Content-Type-Options", "nosniff")
+	w.Header().Set("Content-Security-Policy", "sandbox")
 	// FormatMediaType returns "" for names it cannot encode; don't emit an
 	// empty header in that case.
 	if disposition := mime.FormatMediaType("inline", map[string]string{"filename": filename}); disposition != "" {