Prevent people from adding mime type to supported_non_image_types that will m...

net/base/mime_util.cc

 // Copyright (c) 2006-2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <string>
 
 #include "net/base/mime_util.h"
 #include "net/base/platform_mime_util.h"
 
 #include "base/hash_tables.h"
@@ skipping 221 matching lines @@
   "text/vnd.chromium.ftp-dir",
   "text/",
   "image/svg+xml",  // SVG is text-based XML, even though it has an image/ type
   "application/xml",
   "application/xhtml+xml",
   "application/rss+xml",
   "application/atom+xml",
   "application/json",
   "application/x-x509-user-cert",
   "multipart/x-mixed-replace"
+  // Note: ADDING a new type here will probably render it AS HTML. This can
+  // result in cross site scripting.
 };
+COMPILE_ASSERT(arraysize(supported_non_image_types) == 16,
+               supported_non_images_types_must_equal_16);
 
 //  Mozilla 1.8 and WinIE 7 both accept text/javascript and text/ecmascript.
 //  Mozilla 1.8 accepts application/javascript, application/ecmascript, and
 // application/x-javascript, but WinIE 7 doesn't.
 //  WinIE 7 accepts text/javascript1.1 - text/javascript1.3, text/jscript, and
 // text/livescript, but Mozilla 1.8 doesn't.
 //  Mozilla 1.8 allows leading and trailing whitespace, but WinIE 7 doesn't.
 //  Mozilla 1.8 and WinIE 7 both accept the empty string, but neither accept a
 // whitespace-only string.
 //  We want to accept all the values that either of these browsers accept, but
@@ skipping 190 matching lines @@
 bool AreSupportedMediaCodecs(const std::vector<std::string>& codecs) {
   return GetMimeUtil()->AreSupportedMediaCodecs(codecs);
 }
 
 void ParseCodecString(const std::string& codecs,
                       std::vector<std::string>* codecs_out) {
   GetMimeUtil()->ParseCodecString(codecs, codecs_out);
 }
 
 }  // namespace net