926077 - Firefox sends syntactically wrong Content-Type in file upload

Status: NEW

(Core :: DOM: Core & HTML, defect)

Description

[bogomip]

Attachment: mimeTypes.rdf

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:25.0) Gecko/20100101 Firefox/25.0 (Beta/Release)
Build ID: 20131010180222

Steps to reproduce:

Examine the mimeTypes.rdf of Firefox installations that produce errors with files uploaded to a server. It turned out that the file may contain syntactically wrong content types, i.e. content types enclosed in double quotes. According to RFC 2045 Content-Type value's type/subtype must not be enclosed in double quotes.

https://tools.ietf.org/html/rfc2045#page-12

Corrupted mimeTypes.rdf files seem to appear quite often in real world installations. The attachment contains an example.


Actual results:

Files (PDF in one case) uploaded with Firefox to a web application caused errors in the web application due to a syntactically incorrect content type ("application/pdf" with the quotes) sent along with the file.


Expected results:

Firefox should not send obviously invalid content types to a server when uploading files. A reasonable approach is probably not to store syntactically invalid content types in the mimeTypes.rdf. At least strip surrounding quotes.

Comment 1

[Suzanne Smedberg]

Can you describe where during the upload the error is occurring?  It is not obvious to me in the rdf file above where the error occurs - what line should I be looking at?

Comment 2

[bogomip]

Attachment: Test case in ZIP archive

1. Install node.js (http://nodejs.org/)

2. Start the server: node server.js

3. Connect to http://localhost:8888/ (or the respective remote host)

Comment 3

[bogomip]

The error occurred on the server when it processed the invalid content type sent by Firefox along with the uploaded PDF file.

However, it seems that the wrong content type information is not necessarily taken from the mimeTypes.rdf, as previously supposed.  Under Windows 7 the error can be reproduced by changing the relevant registry value from application/pdf to "application/pdf".  This can easily be done using the registry scripts from the attached test case.

The attached test case also implements a simple HTTP server that lets you reproduce the problem.  It issues an error message if a file with quoted content type "application/pdf" is uploaded.