When the server says "nosniff" but then doesn't give us a Content-Type we now...

chrome/browser/renderer_host/buffered_resource_handler.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/renderer_host/buffered_resource_handler.h"
 
 #include "base/histogram.h"
 #include "net/base/mime_sniffer.h"
 #include "chrome/browser/renderer_host/download_throttling_resource_handler.h"
 #include "chrome/browser/renderer_host/resource_dispatcher_host.h"
@@ skipping 98 matching lines @@
 }
 
 bool BufferedResourceHandler::DelayResponse() {
   std::string mime_type;
   request_->GetMimeType(&mime_type);
 
   std::string content_type_options;
   request_->GetResponseHeaderByName("x-content-type-options",
                                     &content_type_options);
 
-  const bool sniffing_blocked = (content_type_options == "nosniff");
+  const bool sniffing_blocked =
+      LowerCaseEqualsASCII(content_type_options, "nosniff");

[darin (slow to review), 2009/01/23 15:59:05]

good fix

   const bool we_would_like_to_sniff =
       net::ShouldSniffMimeType(request_->url(), mime_type);
 
   RecordSnifferMetrics(sniffing_blocked, we_would_like_to_sniff, mime_type);
 
   if (!sniffing_blocked && we_would_like_to_sniff) {
     // We're going to look at the data before deciding what the content type
     // is.  That means we need to delay sending the ResponseStarted message
     // over the IPC channel.
     sniff_content_ = true;
     LOG(INFO) << "To buffer: " << request_->url().spec();
     return true;
   }
 
+  if (sniffing_blocked && mime_type.empty()) {
+    // Ugg.  The server told us not to sniff the content but didn't give us a
+    // mime type.  What's a browser to do?  Turns out, we're supposed to treat
+    // the response as "text/plain".  This is the most secure option.
+    mime_type.assign("text/plain");
+    response_->response_head.mime_type.assign(mime_type);
+  }
+
   if (ShouldBuffer(request_->url(), mime_type)) {
     // This is a temporary fix for the fact that webkit expects to have
     // enough data to decode the doctype in order to select the rendering
     // mode.
     should_buffer_ = true;
     LOG(INFO) << "To buffer: " << request_->url().spec();
     return true;
   }
   return false;
 }
@@ skipping 104 matching lines @@
     real_handler_ = download_handler;
   }
   return real_handler_->OnResponseStarted(request_id, response_);
 }
 
 bool BufferedResourceHandler::DidBufferEnough(int bytes_read) {
   const int kRequiredLength = 256;
 
   return bytes_read >= kRequiredLength;
 }