CORB's MIME type classification disagrees with the specs |
|||
Issue descriptionCORB explainer [1] refers to the specs for definitions of HTML [2], JSON [3] and XML [4] MIME types. The actual implementation disagrees with these definitions (e.g. CORB treats `application/json+protobuf` as a JSON MIME type). We should make sure the specs and the implementation agree by changing one of them. [1] https://chromium.googlesource.com/chromium/src/+/master/services/network/cross_origin_read_blocking_explainer.md [2] https://mimesniff.spec.whatwg.org/#html-mime-type [3] https://mimesniff.spec.whatwg.org/#json-mime-type [4] https://mimesniff.spec.whatwg.org/#xml-mime-type
,
Mar 28 2018
domenic@ / xtof@ - WDYT about either 1) excluding application/json+protobuf from CORB protection or 2) tweaking the web specs to consider application/json+... to be a JSON MIME type (and similarily for text/json+... and text/xml+... and application/xml+...?). If we decide to drop CORB protection for application/json+protobuf, then I have a WIP CL for this @ https://crrev.com/c/985211
,
Mar 29 2018
This is partially blocked on a Google-internal b/77263433
,
Apr 2 2018
2) seems fine at least for JSON. Currently there is only one place on the platform that uses the "JSON MIME type" definition, and that's the HTML navigation algorithm (where JSON mime types get treated as text instead of binary, basically). For XML I am less sure. Per the MIME Sniffing spec at least, this would mean that e.g. if you send application/xml+foo on a JPEG image, we would stop sniffing and not treat it as JPEG. I think it would also mean that application/xml+foo with a <html> element gets treated as an XHTML document as well? Do we do that? If you Ctrl+F in https://html.spec.whatwg.org/ you can find lots of uses of "XML MIME type".
,
Apr 2 2018
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/5427032a207bd3ccafaa0ee1477c78404c304f3e commit 5427032a207bd3ccafaa0ee1477c78404c304f3e Author: Lukasz Anforowicz <lukasza@chromium.org> Date: Mon Apr 02 23:35:33 2018 Make CORB MIME type classification consistent with the web specs. https://tools.ietf.org/html/rfc7303 says that if "new media type is introduced for an XML-based format, the name of the media type SHOULD end with '+xml'". https://tools.ietf.org/html/rfc6839 covers '+xml' and '+json' suffixes. https://mimesniff.spec.whatwg.org/#xml-mime-type says "An XML MIME type is any MIME type whose subtype ends in '+xml' or whose essence is 'text/xml' or 'application/xml'. [RFC7303]". https://mimesniff.spec.whatwg.org/#json-mime-type says "A JSON MIME type is any MIME type whose subtype ends in '+json' or whose essence is 'application/json' or 'text/json'." There are no occurences of "application/xml+", "text/xml+", "application/json+", "text/json+" or "text/x-json" in the specs above and on various lists of MIME types like: - https://developer.mozilla.org/en-US/docs/Web/HTTP/Basics_of_HTTP/MIME_types/Complete_list_of_MIME_types - https://en.wikipedia.org/wiki/Media_type - https://www.freeformatter.com/mime-types-list.html - https://www.sitepoint.com/mime-types-complete-list/ Bug: 826756 Cq-Include-Trybots: master.tryserver.chromium.linux:linux_mojo Change-Id: Ied30f9728bd4f082bb620fea150f342457ea4833 Reviewed-on: https://chromium-review.googlesource.com/985211 Commit-Queue: Łukasz Anforowicz <lukasza@chromium.org> Reviewed-by: Nick Carter <nick@chromium.org> Cr-Commit-Position: refs/heads/master@{#547565} [modify] https://crrev.com/5427032a207bd3ccafaa0ee1477c78404c304f3e/content/browser/loader/cross_site_document_resource_handler_unittest.cc [modify] https://crrev.com/5427032a207bd3ccafaa0ee1477c78404c304f3e/services/network/cross_origin_read_blocking.cc [modify] https://crrev.com/5427032a207bd3ccafaa0ee1477c78404c304f3e/services/network/cross_origin_read_blocking_unittest.cc [modify] https://crrev.com/5427032a207bd3ccafaa0ee1477c78404c304f3e/third_party/WebKit/LayoutTests/FlagExpectations/site-per-process [modify] https://crrev.com/5427032a207bd3ccafaa0ee1477c78404c304f3e/third_party/WebKit/LayoutTests/TestExpectations [add] https://crrev.com/5427032a207bd3ccafaa0ee1477c78404c304f3e/third_party/WebKit/LayoutTests/external/wpt/fetch/corb/img-mime-types-coverage.tentative.sub.html [modify] https://crrev.com/5427032a207bd3ccafaa0ee1477c78404c304f3e/third_party/WebKit/LayoutTests/external/wpt/fetch/nosniff/image.html [modify] https://crrev.com/5427032a207bd3ccafaa0ee1477c78404c304f3e/third_party/WebKit/LayoutTests/external/wpt/fetch/nosniff/resources/image.py [add] https://crrev.com/5427032a207bd3ccafaa0ee1477c78404c304f3e/third_party/WebKit/LayoutTests/external/wpt/images/green-96x96.svg
,
Apr 3 2018
Thanks lukasza@! Is there more to be done after r547565?
,
Apr 3 2018
No - I think we can mark this as fixed now. I've starred b/77263433, so once that is out of the way we'll be able to also clean up application/json+protobuf (this doesn't seem to be high priority IMO). |
|||
►
Sign in to add a comment |
|||
Comment 1 by lukasza@chromium.org
, Mar 28 2018