We have a requirement to allow users to upload an XML document into our system. We don't process it, we just allow them to download it again.
Given various browser XSS vulnerabilities such as this: http://webstersprodigy.net/2012/02/04/serving-back-xml-for-xss/ (various flavours affecting IE, Chrome and FF)
What is our best approach for safely allowing users to download the document again? Things we've considered so far:
- Wrap the document in a ZIP file for download
- Use a plain/text content type (we've got all the disable content-sniffing headers enabled but haven't yet tested what IE 8 will do in this scenario)
- Something else entirely?