github secure_headers vulnerabilities (CVE)

secure_headers: CSP directive injection via sandbox, plugin_types, and report_to when given untrusted input

secure_headers manages application of security headers with many safe defaults. Prior to 7.3.0, secure_headers builds the Content-Security-Policy value by stitching directives with ; separators, and build_sandbox_list_directive, build_media_type_list_directiv…