All CSP parameters should start with -

This is best described by the docs:
“Each argument name is preceded by a dash. Neither case nor order matters in
the argument list. -type, -Type, and -TYPE are all acceptable. In fact, only
the first argument needs to begin with a dash. If a dash is present in the
first argument, CGI.pm assumes dashes for the subsequent ones.”

We construct our own hash %headers and then pass that to $q->header. Since
hash values are not ordered in any way (in fact the order is pretty much
random), sometimes CSP things will be at the front of the list. Since there
was no leading dashes, these were interpreted as something else.

wiki.pl

@@ -101,6 +101,9 @@ our $EditPass  //= '';              # Whitespace separated passwords.
 our $PassHashFunction //= '';       # Name of the function to create hashes
 our $PassSalt  //= '';              # Salt will be added to any password before hashing
 
+our $UseCsp      = 0;               # 1 = enable Content Security Policy # TODO should be enabled by default
+our %CspDirectives = ('default-src' => ["'self'"], 'style-src' => ['*'], 'img-src' => ['*']); # CSP directives
+
 our $BannedHosts = 'BannedHosts';   # Page for banned hosts
 our $BannedCanRead = 1;             # 1 = banned cannot edit, 0 = banned cannot read
 our $BannedContent = 'BannedContent'; # Page for banned content (usually for link-ban)
@@ -2303,6 +2306,12 @@ sub GetHttpHeader {
   $headers{-Content_Encoding} = $encoding if $encoding;
   my $cookie = Cookie();
   $headers{-cookie} = $cookie if $cookie;
+  if ($UseCsp) {
+    my $csp = join '; ', map { join ' ', $_, @{$CspDirectives{$_}} } sort keys %CspDirectives;
+    $headers{'-Content-Security-Policy'}   = $csp;
+    $headers{'-X-Content-Security-Policy'} = $csp; # required for IE
+    $headers{'-X-Webkit-CSP'}              = $csp; # required for UC browser
+  }
   if ($q->request_method() eq 'HEAD') {
     print $q->header(%headers), "\n\n"; # add newlines for FCGI because of exit()
     exit; # total shortcut -- HEAD never expects anything other than the header!