tree 94abb405d1cb2dbfa2192537974bf7cbd16b4609
parent 8d16fa6dc9a85c1cd3ed24ad08ff21cf94f10888
author Baokun Lee <nototon@gmail.com> 1523794270 +0800
committer Brad Fitzpatrick <bradfitz@golang.org> 1524020057 +0000

http2: don't sniff Content-type in Server when X-Content-Type-Options:nosniff

The header X-Content-Type-Options:nosniff is an explicit directive that
content-type should not be sniffed.

----

https://fetch.spec.whatwg.org/#x-content-type-options-header
defines the X-Content-Type-Options header.

["Polyglots: Crossing Origins by Crossing Formats"](http://citeseerx.ist.psu.edu
/viewdoc/download?doi=10.1.1.905.2946&rep=rep1&type=pdf)
explains Polyglot attacks in more detail.

Fixes golang/go#24795

Change-Id: Ibcc2d6a561394392ad0bf112eecc01c43823a2a2
Reviewed-on: https://go-review.googlesource.com/107295
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>