[css2.1] Handling of style sheets with no MIME type, or an unparseable MIME type from Zack Weinberg on 2010-06-03 (www-style@w3.org from June 2010)

From: Zack Weinberg <zweinberg@mozilla.com>
Date: Thu, 3 Jun 2010 12:51:08 -0700
To: W3C Emailing list for WWW Style <www-style@w3.org>
Message-ID: <20100603125108.38b6f002@moxana.local>

What should an @import rule (or a top-level link from a document -
that's in-scope, because they need to behave the same) do with
data that is served with no content-type header, or an unparseable
content-type header?  (Assume an URI scheme that does provide
HTTP-equivalent content-type data.)

Mozilla happens to treat the absence of a content-type, an unparseable
content-type, and a handful of 'sentinel' values that are not
*supposed* to appear on the wire (but nothing prevents this) as
equivalent to text/css.  However, CVE-2010-0654 (see
https://bugzilla.mozilla.org/show_bug.cgi?id=524223 for extensive
discussion) makes me think this is not a good idea.

zw

Received on Thursday, 3 June 2010 19:51:42 UTC