Subject: Risks with NULL Mime type

From: Amit Aggarwal <[email-masked]>
Date: Thu, 02 Jan 2014 11:58:01 +0900

Hello,

Happy New Year to everyone.

I am not sure if this is the right group for my question. Please advise me
otherwise.

1)      How safe is it for clients to handle NULL mime types and allow
actions based on file extensions when MIME TYPE is null.

Example:  Server is hosting APK file with NULL MIME TYPE. Most browser will
download it but install may fail if browser is checking MIME TYPE for
appropriate handler. One workaround is to check file extension in this case
and search appropriate handler. 

Are there any potential risks to this approach ? 

2)      How common is it to have NULL Mime type files hosted by servers ? 

 

Best Regards

Amit

---

From: "Martin Nilsson" <[email-masked]>
Date: Thu, 02 Jan 2014 14:23:41 +0100

> Are there any potential risks to this approach ?

File extensions tend to not work very well. A more robust method is  
discussed in this WHATWG draft: http://mimesniff.spec.whatwg.org/

> 2)      How common is it to have NULL Mime type files hosted by servers ?

It is very common for files to be served with incorrect MIME type, or  
indeed confusion about what the correct MIME type is.

/Martin Nilsson