Ivo Van Geertruyen
--- a/core/lib/Drupal/Core/EventSubscriber/FileDownloadCspSubscriber.php 0 → 100644
+++ b/core/lib/Drupal/Core/EventSubscriber/FileDownloadCspSubscriber.php 0 → 100644
+  /**
+   * Sets Content-Security-Policy on file downloads.
+   *
+   * @param \Symfony\Component\HttpKernel\Event\ResponseEvent $event
+   *   The event to process.
+   */
+  public function onRespond(ResponseEvent $event): void {
+    if (!$event->isMainRequest()) {
+      return;
+    }
+
+    $response = $event->getResponse();
+
+    if (!($response instanceof BinaryFileResponse)) {
+      return;
+    }