Despite a sound Content Security Policy (CSP) in place, the application was
susceptible to four vulnerabilities:

- The HTTP error handler allows arbitrary content injection
- HTTP responses do not instruct the browser to stop sniffing MIME types
- Untrusted user input is not sanitized correctly, due to a faulty
blacklist-based sanitization function
- A harmless-looking input form allows chaining the above vulnerabilities to a
complete exploit

Refer to my original writeup here: https://www.justus.pw/writeups/sekai-ctf/tagless.html