155529 - Content-type specified by META HTTP-EQUIV ignored when server reports text/plain

Status: VERIFIED DUPLICATE of bug 155530

(Core :: Networking: HTTP, defect)

Description

[Aleksander Adamowski]

The URL shown here gives a page where a misconfigured server specifies
text/plain content type. However, it returns HTML code, and there's a META tag
that speicifes text/html:

<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />

Internet Explorer 6 honors that META tag and displays the page as HTML. It
apparently tries to find a META HTTP-EQUIV tag in all files that have their
top-level media type declared as text (I'd guess it only scans their initial
~100 bytes to reduce overhead processing), and if it's html, treat it as text/html.

I propose that similar media type checking be implemented in Mozilla.
The implementation has to be carefully thought out to avoid security problems -
for example, the explosion of Nimda worm was possible because Internet
Explorer/Outlook Express has a flawed model of content-type determination. The
mail message declared audio/x-wav content type for the file, but its extension
was .exe. When the file was passed to media player from Outlook Express
(according to declared content type), media player run it as an executable
(according to its extension).

Similar dangers may be present when this feature is implemented.

Comment 1

[Aleksander Adamowski]

Sorry, the bug was submitted twice by Moz. Closing.

*** This bug has been marked as a duplicate of 155530 ***

Comment 2

[:deanis74]

v