[whatwg] Style sheet loading and parsing (over HTTP)

[Gervase Markham]

Jon Barnett wrote:
> It's detrimental to the user when the user is denied content or a 
> stylesheet for the content because a server is misconfigured.  There are 
> cases, such as CSS documents and images referenced by CSS documents, 
> where ignoring Content-type is never harmful.  in other cases, the harm 
> can be mitigated by the rules in the spec.

It's also detrimental to the user when they are put at security risk 
because MIME types are not respected.

Recent example: spammers, phishers and other sundry evildoers have 
started attaching HTML attachments to Bugzilla installations, and using 
them as redirectors to their sites, to avoid domain name blacklists in 
spam filtering software.

Obvious solution: if an attachment is uploaded by a user with no 
permissions and its MIME type is one which contains script executed by 
the browser (all HTML types, SVG, ...) then change it to "text/plain". 
This is the least intrusive option - the attachment can still be viewed, 
and someone with permissions can change the MIME type later after 
checking the content.

However, this doesn't protect anyone using IE, because IE claims to know 
better and ignores Content-Type.

Gerv