Serve artifacts of a type that can run script with CSP sandbox and nosniff

backend/tests/test_artifacts.py

@@ -180,3 +180,29 @@ def test_an_upload_may_ask_for_the_ring(
         assert served.content == b"\x89PNG-frame"
     finally:
         store.volatile = previous
+
+
+def test_a_type_that_can_run_script_is_served_sandboxed(
+    client: TestClient, superuser_token_headers: dict[str, str]
+) -> None:
+    """Any member can upload, and the caller names the type it is served as."""
+    url = f"{settings.API_V1_STR}/artifacts"
+    page = client.put(
+        f"{url}?name=x.html", headers=superuser_token_headers, content=b"<script>"
+    ).json()["digest"]
+    image = client.put(
+        f"{url}?name=x.png", headers=superuser_token_headers, content=b"\x89PNG"
+    ).json()["digest"]
+
+    def served(digest: str, media_type: str) -> dict[str, str]:
+        answer = client.get(
+            f"{url}/{digest}?media_type={media_type}", headers=superuser_token_headers
+        )
+        assert answer.status_code == 200
+        return dict(answer.headers)
+
+    for media_type in ("text/html", "image/svg+xml", "application/xml"):
+        headers = served(page, media_type)
+        assert headers["content-security-policy"] == "sandbox"
+        assert headers["x-content-type-options"] == "nosniff"
+    assert "content-security-policy" not in served(image, "image/png")