From 61ebcb6ed4f978df5121426e6ccec91d3ac3ca8f Mon Sep 17 00:00:00 2001
From: the-djmaze <>
Date: Thu, 22 Oct 2026 18:04:40 +0200
Subject: [PATCH] CSP block legacy HTML element types such as <object>,
 <embed>, and <applet> on Raw actions

---
 snappymail/v/0.0.0/app/libraries/RainLoop/ServiceActions.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/snappymail/v/0.0.0/app/libraries/RainLoop/ServiceActions.php b/snappymail/v/0.0.0/app/libraries/RainLoop/ServiceActions.php
index e46b95375..372c0b462 100644
--- a/snappymail/v/0.0.0/app/libraries/RainLoop/ServiceActions.php
+++ b/snappymail/v/0.0.0/app/libraries/RainLoop/ServiceActions.php
@@ -339,7 +339,7 @@ class ServiceActions
 					$sMethodName = 'Raw'.$sAction;
 					if (\method_exists($this->oActions, $sMethodName)) {
 						\header('X-Raw-Action: '.$sMethodName);
-						\header('Content-Security-Policy: script-src \'none\'; child-src \'none\'');
+						\header('Content-Security-Policy: script-src \'none\'; child-src \'none\'; object-src \'none\'');
 
 						$sRawError = '';
 						$this->oActions->SetActionParams(array(