Tests for MIME sniffing?

[Manishearth]

I couldn't find any tests for MIME sniffing except for fetch/nosniff.

We should add some tests that fetch various resources via an iframe (or XHR if that would work) and check the mime type.

https://mimesniff.spec.whatwg.org

[annevk]

There should be a lot of tests somewhere for this. I imagine the Gecko and Chrome/WebKit source trees have them.

[annevk]

Note that I've since landed tests for MIME type parsing. Sniffing algorithm is not yet covered though.

[MattMenke2]

annevk: I think the MIME parsing tests could still be beefed up, to poke around edges of the spec, where I think it's likely that even browsers that pass all tests may differ in behaviors. Some suggestions:

text/html;charset= "gbk" (I don't think this should be parsed as GBK, since the pseudo code in the spec only looks for quotes immediately after the =)
text/html;charset=();charset=GBK (This should parse as GBK, since "(" and ")" are explicitly excluded as valid characters in parameter values - could do a similar test for the name, but that seems to matter much less)
text/html;charset=';charset=GBK (This should not parse as GBK, since "'" is allowed in names. Could add tests for every non-alpha numeric character, but that may be overkill)
text/html;charset=" gbk" (I think that this should be treated as GBK)
text/html;charset="gbk " (I think that this should be treated as GBK)

[MattMenke2]

And a couple more:

text/html;charset= ";charset=GBK (Parses as GBK - first parses as space-quote, and quotes aren't allowed in names, so it's skipped in favor of the second one)
text/html;charset=";charset=GBK (Does not parse as GBK)
text/html;charset=";charset=GBK";charset=GBK (Does parse as GBK, since semi-colons aren't allowed)
text/html;charset="";charset=GBK (Parses as GBK, since empty names won't be set)