HTML Standard Tracker

Diff (omit for latest revision)
Filter

Short URL: http://html5.org/r/2096

File a bug

SVNBugCommentTime (UTC)
2096Make it impossible for an SVG file not labelled as SVG to be sniffed as a valid image in <img> (that would allow privilege escalation), but do allow a correctly-labelled SVG to be processed as such.2008-08-21 10:06
Index: source
===================================================================
--- source	(revision 2095)
+++ source	(revision 2096)
@@ -3697,8 +3697,7 @@
    <li><p>If <var title="">official type</var> ends in "+xml", or if
    it is either "text/xml" or "application/xml", then the sniffed
    type of the resource is <var title="">official type</var>; return
-   that and abort these steps.</p></li> <!-- we don't want
-   image/svg+xml going through the next step -->
+   that and abort these steps.</p></li>
 
    <li><p>If <var title="">official type</var> is an image type
    supported by the user agent (e.g. "image/png", "image/gif",
@@ -4081,8 +4080,12 @@
 
   <h4><dfn>Content-Type sniffing: image</dfn></h4>
 
-  <p>If the first bytes of the resource match one of the byte
-  sequences in the first column of the following table, then the
+  <p>If the resource's <var title="">official type</var> is
+  "image/svg+xml", then the sniffed type of the resource is its <var
+  title="">official type</var> (an XML type).</p>
+
+  <p>Otherwise, if the first bytes of the resource match one of the
+  byte sequences in the first column of the following table, then the
   sniffed type of the resource is the type given in the corresponding
   cell in the second column on the same row:</p>
 
@@ -13560,7 +13563,9 @@
   sniffing: image">image sniffing rules</span> to determine the type
   of the image, with the image's <span title="Content-Type">associated
   Content-Type headers</span> giving the <var title="">official
-  type</var>.</p>
+  type</var>. If these rules are not applied, then the type of the
+  image must be the type given by the image's <span
+  title="Content-Type">associated Content-Type headers</span>.</p>
 
   <p>User agents must not support non-image resources with the
   <code>img</code> element (e.g. XML files whose root element is an

|