Use a header instead of a meta tag for Content-Security-Policy, because we can't guarantee that we are parsing all HTML files.

Also use default-src instead of connect-src, as we want to block all external requests.

src/main/java/org/qortal/api/HTMLParser.java

@@ -28,10 +28,6 @@ public class HTMLParser {
             // Add base href tag
             String baseElement = String.format("<base href=\"%s\">", baseUrl);
             head.get(0).prepend(baseElement);
-
-            // Add security policy tag
-            String securityPolicy = String.format("<meta http-equiv=\"Content-Security-Policy\" content=\"connect-src 'self'\">");
-            head.get(0).prepend(securityPolicy);
         }
         String html = document.html();
         this.data = html.getBytes();

src/main/java/org/qortal/arbitrary/ArbitraryDataRenderer.java

@@ -119,6 +119,7 @@ public class ArbitraryDataRenderer {
                 byte[] data = Files.readAllBytes(Paths.get(filePath)); // TODO: limit file size that can be read into memory
                 HTMLParser htmlParser = new HTMLParser(resourceId, inPath, prefix, usePrefix, data);
                 htmlParser.addAdditionalHeaderTags();
+                response.addHeader("Content-Security-Policy", "default-src 'self'");
                 response.setContentType(context.getMimeType(filename));
                 response.setContentLength(htmlParser.getData().length);
                 response.getOutputStream().write(htmlParser.getData());
@@ -127,6 +128,7 @@ public class ArbitraryDataRenderer {
                 // Regular file - can be streamed directly
                 File file = new File(filePath);
                 FileInputStream inputStream = new FileInputStream(file);
+                response.addHeader("Content-Security-Policy", "default-src 'self'");
                 response.setContentType(context.getMimeType(filename));
                 int bytesRead, length = 0;
                 byte[] buffer = new byte[10240];