On Jan 13, 2005, at 10:37 AM, Matthew Mullenweg wrote:
Brion Vibber wrote:
Even though the wiki sends a "Content-type:
text/x-wiki" header, the
I think this is the problem in the first place. IE only guesses the
content type if the MIME is something weird that it doesn't recognize.
Actually, that's not true. IE will attempt type recognition from the
content if it *does* recognize the content-type, or if it *does*
recognize the "file extension" on the URL.
If it *doesn't* recognize the content-type and it *doesn't* recognize
the "file extension", then the content-type is taken at face value,
usually.
Would it be that bad to make it something like
text/plain? It seems
like the current fix, while it works, has caused a lot of needless
confusion.
We changed it *from* text/plain to prevent the automatic interpretation
of data as HTML by Internet Explorer whenever the first 200 bytes
contained '<html', '<head', '<body', or
'<script'.
Official documentation on IE's MIME guessing:
http://msdn.microsoft.com/library/default.asp?url=/workshop/
networking/moniker/overview/appendix_a.asp
You'll notice it says that an unrecognized type will not be
autodetected:
"1. If the "suggested" (server-provided) MIME type is unknown (not
known and not ambiguous), FindMimeFromData immediately returns this
MIME type as the final determination. The reason for this is that new
MIME types are continually emerging, and these MIME types might have
formats that are difficult to distinguish from the set of hard-coded
MIME types for which tests exist. A good example of this is SGML, which
can easily be classified incorrectly as HTML because it contains many
of the same tags. Rather than weakening the hard-coded tests or risk
incorrectly classifying new and as-yet-unknown MIME types for
hard-coded known ones, priority is given to the server-supplied MIME
type if it is unknown, since these MIME types are both specific and
likely uncommon, and there are no hard-coded tests that can positively
identify them."
Note that "text/plain" is explicitly listed as an "ambiguous" type
which will always trigger type autodetection, which is why it cannot be
used safely for user-supplied content.
-- brion vibber (brion @
pobox.com)
