3 ms·
Maybe it's something to do with a MIME sniffing attack. The user profile URL may be detected as a different MIME type by the browser based on the extension: htt
by amjd 5y ago
Maybe it's something to do with a MIME sniffing attack. The user profile URL may be detected as a different MIME type by the browser based on the extension: https://gitlab.com/myname.js https://gitlab.com/myname.js
I'm not sure how one could exploit it though...
- citrin_ru 5y agoAFAIK in MIME sniffing IE guessed file type based on its content [1], not URL. And given that IE is rarely used nowadays not sure if it still relevant. [1]: https://docs.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/platform-apis/ms775147(v=vs.85) https://docs.microsoft.com/en-us/previous-versions/windows/i... Update: tested this link in FireFox 92 - it still performs sniffing in 2021: http://www.debugtheweb.com/test/mime/script.asp http://www.debugtheweb.com/test/mime/script.asp (based on the content, not extension)