[Bug]: CSP problem in file sharing causes page to refresh

[larsrh]

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

Due to malformed CSP, a bunch of JS files cannot be loaded. Excerpt from the web inspector (URLs redacted):

Content-Security-Policy: The page’s settings blocked the loading of a resource at inline (“script-src”).
Source: event.preventDefault() 4 [Daw4...](https://cloud.example.org/index.php/s/Daw4...)
Loading failed for the <script> with source “https://cloud.example.org/apps/theming/js/theming.js?v=116e031d-0”. 
Loading failed for the <script> with source “https://cloud.example.org/dist/core-files_fileinfo.js?v=116e031d-0”. 
...

This causes follow-on problems:

Uncaught TypeError: OC.Files is undefined
    7913 client.js:1004
    Webpack 5
[client.js:1004:7](webpack:///nextcloud/core/src/files/client.js)

... and a lot more.

This ultimately causes the page to refresh and not display any of the files.

This Nextcloud installation has been running for years and is kept updated (currently 28.0.1). All apps are also up to date.

Steps to reproduce

1. Generate a share link for a folder with anonymous access (looks like this: https://cloud.example.org/index.php/s/Daw4...)
2. Open the share link, either logged in as a different user or in a private browsing window
3. Page does not show any files, keeps refreshing

Expected behavior

Page should not refresh and show the files

Installation method

None

Nextcloud Server version

28

Operating system

None

PHP engine version

None

Web server

Apache (supported)

Database engine version

MySQL

Is this bug present after an update or on a fresh install?

None

Are you using the Nextcloud Server Encryption module?

None

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

No response

List of activated Apps

No response

Nextcloud Signing status

No errors have been found.

Nextcloud Logs

No response

Additional info

No response

[joshtrichards]

👍 Sounds like #42200
Let's consolidate there.

[larsrh]

@joshtrichards Spot on, thanks!