1978315 - Stop using the type attribute of HTML anchors as a content type hint

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, task)

Description

[Tom Schuster (MoCo)]

We seem to use type as in <a type="text/html href="...">..</a> as a Content-Type hint for the loading document. It seems like Chrome doesn't do this. This could possibly be used for some kind of attack, where we interpret something as e.g. HTML that would not sniff in other browsers. Additionally the HTML spec says the following:

The type attribute, if present, gives the MIME type of the linked resource. It is purely advisory. The value must be a valid MIME type string. User agents must not consider the type attribute authoritative — upon fetching the resource, user agents must not use metadata included in the link to the resource to determine its type.

https://html.spec.whatwg.org/multipage/links.html#attr-hyperlink-type

Comment 1

[Tom Schuster (MoCo)]

Attachment: Bug 1978315 - Stop using the type attribute of HTML anchors as a content type hint. r?#dom-core

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/11aaf102b9e8
https://hg.mozilla.org/integration/autoland/rev/476b0361e52c
Stop using the type attribute of HTML anchors as a content type hint. r=dom-core,edgar

Comment 3

[Tom Schuster (MoCo)]

Attachment: Bug 1978315 - A element type attribute is purely historical. r?edgar

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/5768e5e2469b
https://hg.mozilla.org/integration/autoland/rev/d7384701df0f
A element type attribute is purely historical. r=edgar

Comment 5

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/53920 for changes under testing/web-platform/tests

Comment 6

[Cristina Horotan [:chorotan]]

https://hg.mozilla.org/mozilla-central/rev/476b0361e52c
https://hg.mozilla.org/mozilla-central/rev/d7384701df0f

Comment 7

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot