Permalink
Browse files

[] (0) Make it impossible for an SVG file not labelled as SVG to be s…

…niffed as a valid image in <img> (that would allow privilege escalation), but do allow a correctly-labelled SVG to be processed as such.

git-svn-id: http://svn.whatwg.org/webapps@2096 340c8d12-0b0e-0410-8428-c7bf67bfef74
  • Loading branch information...
1 parent bae5477 commit 0ec7d80397842c80600b9612ee1596c109eca47c @Hixie Hixie committed Aug 21, 2008
Showing with 22 additions and 13 deletions.
  1. +12 −8 index
  2. +10 −5 source
View
20 index
@@ -5736,9 +5736,6 @@
either "text/xml" or "application/xml", then the sniffed type of the
resource is <var title="">official type</var>; return that and abort
these steps.
- </li>
- <!-- we don't want
- image/svg+xml going through the next step -->
<li>
<p>If <var title="">official type</var> is an image type supported by the
@@ -6199,10 +6196,14 @@
<h4 id=content-type3><span class=secno>2.7.5 </span><dfn
id=content-type8>Content-Type sniffing: image</dfn></h4>
- <p>If the first bytes of the resource match one of the byte sequences in
- the first column of the following table, then the sniffed type of the
- resource is the type given in the corresponding cell in the second column
- on the same row:
+ <p>If the resource's <var title="">official type</var> is "image/svg+xml",
+ then the sniffed type of the resource is its <var title="">official
+ type</var> (an XML type).
+
+ <p>Otherwise, if the first bytes of the resource match one of the byte
+ sequences in the first column of the following table, then the sniffed
+ type of the resource is the type given in the corresponding cell in the
+ second column on the same row:
<table>
<thead>
@@ -16077,7 +16078,10 @@ interface <dfn id=htmlimageelement>HTMLImageElement</dfn> : <a href="#htmlelemen
title="Content-Type sniffing: image">image sniffing rules</a> to determine
the type of the image, with the image's <a href="#content-type5"
title=Content-Type>associated Content-Type headers</a> giving the <var
- title="">official type</var>.
+ title="">official type</var>. If these rules are not applied, then the
+ type of the image must be the type given by the image's <a
+ href="#content-type5" title=Content-Type>associated Content-Type
+ headers</a>.
<p>User agents must not support non-image resources with the <code><a
href="#img">img</a></code> element (e.g. XML files whose root element is
View
15 source
@@ -3697,8 +3697,7 @@
<li><p>If <var title="">official type</var> ends in "+xml", or if
it is either "text/xml" or "application/xml", then the sniffed
type of the resource is <var title="">official type</var>; return
- that and abort these steps.</p></li> <!-- we don't want
- image/svg+xml going through the next step -->
+ that and abort these steps.</p></li>
<li><p>If <var title="">official type</var> is an image type
supported by the user agent (e.g. "image/png", "image/gif",
@@ -4081,8 +4080,12 @@
<h4><dfn>Content-Type sniffing: image</dfn></h4>
- <p>If the first bytes of the resource match one of the byte
- sequences in the first column of the following table, then the
+ <p>If the resource's <var title="">official type</var> is
+ "image/svg+xml", then the sniffed type of the resource is its <var
+ title="">official type</var> (an XML type).</p>
+
+ <p>Otherwise, if the first bytes of the resource match one of the
+ byte sequences in the first column of the following table, then the
sniffed type of the resource is the type given in the corresponding
cell in the second column on the same row:</p>
@@ -13560,7 +13563,9 @@ interface <dfn>HTMLImageElement</dfn> : <span>HTMLElement</span> {
sniffing: image">image sniffing rules</span> to determine the type
of the image, with the image's <span title="Content-Type">associated
Content-Type headers</span> giving the <var title="">official
- type</var>.</p>
+ type</var>. If these rules are not applied, then the type of the
+ image must be the type given by the image's <span
+ title="Content-Type">associated Content-Type headers</span>.</p>
<p>User agents must not support non-image resources with the
<code>img</code> element (e.g. XML files whose root element is an

0 comments on commit 0ec7d80

Please sign in to comment.