3 ms·

MIME types are used all over the place: 1) web servers, browsers, proxies 2) graphical os shells 3) email every file a webserver returns has a mime type in th

• dolmen 5y ago
  The ticket here reveals some blacklisting of known file extensions (attached to a know list of MIME type), not MIME types directly.
• mmis1000 5y ago
  Even webserver returns a mime, browser may sometimes still ignore it and guess it themselves, because server may be wrong. Unless the server ask them `absolutely don't do it` via the header. a.k.a. `X-Content-Type-Options: nosniff` But even there is a header for that, there will still be situations that clients don't care and guess it themselves (probably because software is too old or other reason).
  • amenghra 5y ago
    Correct. You want to set Content-Type and X-Content-Type-Options. The story is that in some cases, Internet Explorer could be tricked to ignore the Content-Type header. Instead of fixing the core bug, Microsoft decided to add a header (presumably, they didn’t want to break existing websites). A decade later, people discovered two ways to bypass X-Content-Type-Options. This time, Microsoft fixed the core issue instead of adding X-Content-Type-Options-For-Reals.
    • hannob 5y ago
      Actually when I reported security issues with XCTO:nosniff to Microsoft the answer was something like "well... we don't care, but you can hope that with Edge going to chromium engine things will change". Firefox fixed it eventually. FWIW background https://www.youtube.com/watch?v=8t8JYpt0egE https://www.youtube.com/watch?v=8t8JYpt0egE
    • mmis1000 5y ago
      > could be tricked to ignore the Content-Type I think even browser nowadays still do it. A file in <script src="" /> will be treated as script even mime is wrong. A file ended with .mp4 will be play as video even it says it is a text/plain file. Browser guess mime from contents at many places, just you may not notice it. unless XCTO is set