Content-Security-Policy header generation in middleware could be compromised by malicious injections