From ab1d818f4f5719b604bd06506ae58690f474b1ec Mon Sep 17 00:00:00 2001
From: GhostlyDark <31742919+GhostlyDark@users.noreply.github.com>
Date: Fri, 14 Mar 2025 18:11:34 +0100
Subject: [PATCH] Add CSP to mitigate XSS

---
 index.html          | 1 +
 index_template.html | 1 +
 2 files changed, 2 insertions(+)
diff --git a/index.html b/index.html
index b615605..e6cb341 100644
--- a/index.html
+++ b/index.html
@@ -3,6 +3,7 @@
 <head>
 	<title>Rom Patcher JS</title>
 	<meta http-equiv="content-Type" content="text/html; charset=UTF-8"/>
+	<meta http-equiv="Content-Security-Policy" content="script-src 'self'"/>
 	<meta name="description" content="An online web-based ROM patcher. Supported formats: IPS, BPS, UPS, APS, RUP, PPF and xdelta."/>
 	<meta name="keywords" content="ips,ups,aps,bps,rup,ninja,ppf,xdelta,patcher,online,html5,web,rom,patch,hack,translation"/>
 	<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=0"/>
diff --git a/index_template.html b/index_template.html
index 7c57d90..3cd9424 100644
--- a/index_template.html
+++ b/index_template.html
@@ -4,6 +4,7 @@
 <head>
 	<title>Rom Patcher JS - Custom patcher template</title>
 	<meta http-equiv="content-Type" content="text/html; charset=UTF-8" />
+	<meta http-equiv="Content-Security-Policy" content="script-src 'self' 'unsafe-inline'" />
 	<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=0" />
 
 
