fix: return 400 instead of panicking on invalid CSP header value (#8810)

Signed-off-by: Rodolfo Olivieri <rolivier@redhat.com>
2026-05-12 15:16:48 -03:00
parent 60abcec993
commit 1dc2749430
1 changed files with 13 additions and 2 deletions
@@ -255,10 +255,21 @@ async fn serve_guest_html(
            // no-referrer would cause 401s from SDK servers.
            headers.insert(
                header::HeaderName::from_static("referrer-policy"),
-                "strict-origin".parse().unwrap(),
+                header::HeaderValue::from_static("strict-origin"),
            );
            if !csp.is_empty() {
-                headers.insert(header::CONTENT_SECURITY_POLICY, csp.parse().unwrap());
+                match csp.parse::<header::HeaderValue>() {
+                    Ok(csp_value) => {
+                        headers.insert(header::CONTENT_SECURITY_POLICY, csp_value);
+                    }
+                    Err(_) => {
+                        return (
+                            StatusCode::BAD_REQUEST,
+                            "Invalid characters in Content-Security-Policy value",
+                        )
+                            .into_response();
+                    }
+                }
            }
            response
        }