diff --git a/core/core.js b/core/core.js
index a55f2c9b..cf8759ac 100644
--- a/core/core.js
+++ b/core/core.js
@@ -473,7 +473,7 @@ function startsWithBytes(data, bytes) {
 	if (data.byteLength >= bytes.length) {
 		let dataBytes = new Uint8Array(data.slice(0, bytes.length));
 		for (let i = 0; i < bytes.length; i++) {
-			if (dataBytes[i] != bytes[i] && bytes[i] !== null) {
+			if (dataBytes[i] !== bytes[i] && bytes[i] !== null) {
 				return;
 			}
 		}
@@ -561,7 +561,7 @@ function guessTypeFromName(path) {
 function guessTypeFromMagicBytes(data) {
 	for (let magic of k_magic_bytes) {
 		if (startsWithBytes(data, magic.bytes)) {
-			return magic.content_type;
+			return magic.type;
 		}
 	}
 }
@@ -621,7 +621,9 @@ async function blobHandler(request, response, blobId, uri) {
 		let data;
 		let match;
 		let query = form.decodeForm(request.query);
-		let headers = {};
+		let headers = {
+			'Content-Security-Policy': 'sandbox',
+		};
 		if (query.filename && query.filename.match(/^[A-Za-z0-9\.-]*$/)) {
 			headers['Content-Disposition'] = `attachment; filename=${query.filename}`;
 		}