When the server says "nosniff" but then doesn't give us a Content-Type we now...

When the server says "nosniff" but then doesn't give us a Content-Type we now treat the response as "text/plain".  Before, we treated the response as a download.  This behavior is (a) safer and (b) matches what we expect in IE8.

R=darin


Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=8559

[abarth-chromium, 2009-01-23 05:57:37]

I'm not sure how to write a test for this.  How can a ui_test tell that its page
rendered as text/plain instead of causing a download?

[darin (slow to review), 2009-01-23 15:59:05]

LGTM

http://codereview.chromium.org/18549/diff/4/202
File chrome/browser/renderer_host/buffered_resource_handler.cc (right):

http://codereview.chromium.org/18549/diff/4/202#newcode120
Line 120: LowerCaseEqualsASCII(content_type_options, "nosniff");
good fix