Fix XSS issue in a HTML attachment preview

Reported by aikido_security

Author: alecpl

CHANGELOG.md

@@ -8,6 +8,7 @@
 - Security: Fix remote image blocking bypass via various SVG animate attributes
 - Security: Fix remote image blocking bypass via a crafted body background attribute
 - Security: Fix fixed position mitigation bypass via use of !important
+- Security: Fix XSS issue in a HTML attachment preview
 
 ## Release 1.5.13
 

program/include/rcmail_action.php

@@ -683,6 +683,9 @@ public static function display_uploaded_file($file)
             header('Content-Type: ' . $file['mimetype']);
             header('Content-Length: ' . $file['size']);
 
+            // Use strict security policy to make sure no javascript is executed
+            header("Content-Security-Policy: script-src 'none'");
+
             if (isset($file['data']) && is_string($file['data'])) {
                 echo $file['data'];
             }