Hacker News new | past | comments | ask | show | jobs | submit login

That's on your file system.

The HTTP protocol specifies that, if the server says a document is 'text/plain', the client must not attempt to second-guess it based on content.

IE second-guesses it based on content, so you cannot serve up something that looks like HTML as text/plain to get it to display.

Substantially worse, IMO.

That said, it'd be better to actually save content types in extended attributes or something. And make all applications magically save and respect these attributes.




Actually MS broke HTTP protocol on that one and it lead to some very interesting exploits. Malicious user could upload a GIF to some site which allowed image uploads. Image would appear normal to a casual observer, except that it was specially crafted so that IE thought it was actually a JavaScript file (because it guessed the file type on its contents and didn't obey server-side set MIME types) and executed it -> XSS.

I don't think Linux does anything remotely like this. It does allow you to use "file" utility to guess the contents of the file, but it doesn't act on it.




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: