docs: def send_stream(stream, filename, size, mtime, mimetype=None, restricted=True,
                  as_attachment=False, etag=None, content_md5=None,
                  chunk_size=None, conditional=True, trusted=False):
      """Send the contents of a file to the client.
  
      .. warning::
  
          It is very easy to be exposed to Cross-Site Scripting (XSS) attacks if
          you serve user uploaded files. Here are some recommendations:
  
              1. Serve user uploaded files from a separate domain
                 (not a subdomain). This way a malicious file can only attack
                 other user uploaded files.
              2. Prevent the browser from rendering and executing HTML files (by
                 setting ``trusted=False``).
              3. Force the browser to download the file as an attachment
                 (``as_attachment=True``).
  
      :param stream: The file stream to send.
      :param filename: The file name.
      :param size: The file size.
      :param mtime: A Unix timestamp that represents last modified time (UTC).
      :param mimetype: The file mimetype. If ``None``, the module will try to
          guess. (Default: ``None``)
      :param restricted: If the file is not restricted, the module will set the
          cache-control. (Default: ``True``)
      :param as_attachment: If the file is an attachment. (Default: ``False``)
      :param etag: If defined, it will be set as HTTP E-Tag.
      :param content_md5: If defined, a HTTP Content-MD5 header will be set.
      :param chunk_size: The chunk size.
      :param conditional: Make the response conditional to the request.
          (Default: ``True``)
      :param trusted: Do not enable this option unless you know what you are
          doing. By default this function will send HTTP headers and MIME types
          that prevents your browser from rendering e.g. a HTML file which could
          contain a malicious script tag.
          (Default: ``False``)
      :returns: A Flask response instance.
      """
      chunk_size = chunk_size_or_default(chunk_size)
  
      # Guess mimetype from filename if not provided.
      if mimetype is None and filename:
          mimetype = mimetypes.guess_type(filename)[0]
      if mimetype is None:
          mimetype = 'application/octet-stream'
  
      # Construct headers
      headers = Headers()
      headers['Content-Length'] = size
      if content_md5:
          headers['Content-MD5'] = content_md5
  
      if not trusted:
          # Sanitize MIME type
          mimetype = sanitize_mimetype(mimetype, filename=filename)
          # See https://www.owasp.org/index.php/OWASP_Secure_Headers_Project
          # Prevent JavaScript execution
          headers['Content-Security-Policy'] = "default-src 'none';"
          # Prevent MIME type sniffing for browser.
          headers['X-Content-Type-Options'] = 'nosniff'
          # Prevent opening of downloaded file by IE
          headers['X-Download-Options'] = 'noopen'
          # Prevent cross domain requests from Flash/Acrobat.
          headers['X-Permitted-Cross-Domain-Policies'] = 'none'
          # Prevent files from being embedded in frame, iframe and object tags.
          headers['X-Frame-Options'] = 'deny'
          # Enable XSS protection (IE, Chrome, Safari)
          headers['X-XSS-Protection'] = '1; mode=block'
  
      # Force Content-Disposition for application/octet-stream to prevent
      # Content-Type sniffing.
      if as_attachment or mimetype == 'application/octet-stream':
          # See https://github.com/pallets/flask/commit/0049922f2e690a6d
          try:
              filenames = {'filename': filename.encode('latin-1')}
          except UnicodeEncodeError:
              filenames = {'filename*': "UTF-8''%s" % url_quote(filename)}
              encoded_filename = (unicodedata.normalize('NFKD', filename)
                                  .encode('latin-1', 'ignore'))
              if encoded_filename:
                  filenames['filename'] = encoded_filename
          headers.add('Content-Disposition', 'attachment', **filenames)
      else:
          headers.add('Content-Disposition', 'inline')
  
      # Construct response object.
      rv = current_app.response_class(
          FileWrapper(stream, buffer_size=chunk_size),
          mimetype=mimetype,
          headers=headers,
          direct_passthrough=True,
      )
  
      # Set etag if defined
      if etag:
          rv.set_etag(etag)
  
      # Set last modified time
      if mtime is not None:
          rv.last_modified = int(mtime)
  
      # Set cache-control
      if not restricted:
          rv.cache_control.public = True
          cache_timeout = current_app.get_send_file_max_age(filename)
          if cache_timeout is not None:
              rv.cache_control.max_age = cache_timeout
              rv.expires = int(time() + cache_timeout)
  
      if conditional:
          rv = rv.make_conditional(request)
  
      return rv