1811029 - X-Content-Type-Options: "nosniff" does not prevent loading script when "nosniff" is quoted

Status: UNCONFIRMED

(Core :: Audio/Video: Playback, defect)

Description

[Sjoerd]

Steps to reproduce:

I have a JavaScript file with Content-Type text/html, which I include from another page. I disable content sniffing with the header X-Content-Type-Options: "nosniff", where nosniff is surrounded by double quotes.

According to the fetch spec, the value should be determined by "getting, decoding, and splitting", which allows double quotes around values.

test.php
<?php
header('Content-Type: text/html');
header('X-Content-Type-Options: "nosniff"');
?>
alert(1);

test2.php:
<script src="test.php"></script>

Actual results:

The script is loaded and executed.

Expected results:

The script is blocked, because I am trying to load a text/html as script and I have nosniff enabled.

Comment 1

[BugBot [:suhaib / :marco]]

The Bugbug bot thinks this bug should belong to the 'Core::Audio/Video: Playback' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[BugBot [:suhaib / :marco]]

The severity field is not set for this bug.
:jimm, could you have a look please?

For more information, please visit auto_nag documentation.