Sandbox upstream content on package routes

[simonchrz]

Package routes share an origin with /ui, and their responses carry bodies and Content-Type values the proxy doesn't control.

Problem

serveArtifactResponse sets Content-Type from the artifact's recorded media type. That type comes from the upstream response, or from whoever pushed a hosted package. Relayed and cached metadata responses also pass upstream headers through. Neither sends X-Content-Type-Options or a Content-Security-Policy.

So an artifact served as text/html or image/svg+xml runs its scripts on the proxy's origin with access to /ui. Sources include a generic upstream, a private registry, a hosted push, or a block page cached as an artifact. Browsers may also sniff an untyped body into HTML.

browse.go already sends Content-Security-Policy: sandbox and X-Content-Type-Options: nosniff for archive files viewed from /ui. This applies the same two headers to the package routes.

Changes

• New middleware: sandboxUpstreamContent sets X-Content-Type-Options: nosniff and Content-Security-Policy: sandbox on every package-route response, mounted alongside rejectQueryInPath. That covers cached and streamed artifacts, cached metadata, relayed upstream responses and errors.
• Effect: content that a browser does render runs with scripts disabled and an opaque origin.
• No client impact: package managers ignore both headers.

Tests

TestPackageRoutesSandboxUpstreamContent mounts the real package routes against a test upstream that serves <script> as text/html. It checks both headers on:

• a generic artifact, on the first fetch and from the cache;
• a relayed APK file;
• an error response.

It failed on all three before the change, and fails again with the middleware removed.

go test -race ./... and golangci-lint v2.13.1 pass.

Also in this PR

Give the detached fetch test time on slow runners fixes a flaky test that's unrelated to the change above. TestServerKeepsFetchAfterClientHangsUp failed once on Windows CI here: the follow-up request timed out after 5 s, in a run where the whole test took 13 s. It passes locally under -race -cpu 1 30 times out of 30. The test checks the outcome (200, body, one upstream fetch), not the speed, so the two 5 s budgets are now 30 s.

[andrew]

Thanks. Covering every package route in one middleware is the right place for this, and relayed upstream CSPs only add to sandbox rather than replacing it.