Merge pull request #13927 from dashevchenko/svgCodeInjection

Malicious code injection into the SVG image vulnerability

application/src/main/java/org/thingsboard/server/controller/ImageController.java

@@ -300,6 +300,7 @@ public class ImageController extends BaseController {
         tbImageService.putETag(cacheKey, descriptor.getEtag());
         var result = ResponseEntity.ok()
                 .header("Content-Type", descriptor.getMediaType())
+                .header("Content-Security-Policy", "default-src 'none'")
                 .eTag(descriptor.getEtag());
         if (!cacheKey.isPublic()) {
             result