Don't use SVG resource documents with an unrecognized MIME-type

third_party/WebKit/Source/core/fetch/DocumentResource.cpp

 /*
     Copyright (C) 2010 Rob Buis <rwlbuis@gmail.com>
     Copyright (C) 2011 Cosmin Truta <ctruta@gmail.com>
     Copyright (C) 2012 University of Szeged
     Copyright (C) 2012 Renata Hodovan <reni@webkit.org>
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
     version 2 of the License, or (at your option) any later version.
@@ skipping 49 matching lines @@
     m_decoder->setEncoding(chs, TextResourceDecoder::EncodingFromHTTPHeader);
 }
 
 String DocumentResource::encoding() const
 {
     return m_decoder->encoding().name();
 }
 
 void DocumentResource::checkNotify()
 {
-    if (m_data) {
+    if (m_data && mimeTypeAllowed()) {
         StringBuilder decodedText;
         decodedText.append(m_decoder->decode(m_data->data(), m_data->size()));
         decodedText.append(m_decoder->flush());
         // We don't need to create a new frame because the new document belongs to the parent UseElement.
         m_document = createDocument(response().url());
         m_document->setContent(decodedText.toString());
     }
     Resource::checkNotify();
 }
 
+bool DocumentResource::mimeTypeAllowed() const
+{
+    ASSERT(type() == SVGDocument);
+    AtomicString mimeType = response().mimeType();
+    if (response().isHTTP())
+        mimeType = httpContentType();
+    return mimeType == "image/svg+xml"
+        || mimeType == "text/xml"
+        || mimeType == "application/xml"
+        || mimeType == "application/xhtml+xml";
+}
+
 PassRefPtrWillBeRawPtr<Document> DocumentResource::createDocument(const KURL& url)
 {
     switch (type()) {
     case SVGDocument:
         return XMLDocument::createSVG(DocumentInit(url));
     default:
         // FIXME: We'll add more types to support HTMLImports.
         ASSERT_NOT_REACHED();
         return nullptr;
     }
 }
 
 } // namespace blink