Questions tagged [mime-type]

The tag has no usage guidance.

3
votes
2answers
88 views

Is it necessarily Content spoofing if the content type of the response does not match the content type of the request?

The security team of my company is stating that content spoofing occurs when they send a different "content-type" for an HTTP request that only accepts JSON content type, and the server response is an ...
1
vote
1answer
224 views

Is XSS via MIME sniffing a Stored or Reflected XSS?

The title says it all. I understand how to exploit XSS via MIME sniffing, but the question is, do you call this type of XSS stored or reflected? OWASP says Stored attacks are those where the ...
1
vote
2answers
2k views

File upload not checking on mime type

So, I have an upload functionality where extension of the filetype is checked correctly (and not currently bypassable). But the mime type is not checked. Does this leave me with some residual risk or ...
1
vote
3answers
4k views

MIME Type vs. Magic Numbers

I'm interested in a comparison of the two with regards to what's more secure when uploading files on a website (that I'm a programmer for). Mozilla's page about MIME Types states that "On the Web, ...
5
votes
1answer
880 views

MIME types that allow XSS in modern browsers

Assume that it is possible to host arbitrary files on goodguys.com, which are delivered with an attacker-controlled MIME type and X-Content-Type-Options=nosniff. Which MIME types allow for XSS when ...
1
vote
2answers
117 views

Why is “ Generic MIME used” a security vulnerability?

Some web application security scanners like Skipfish reports vulnerability "Generic MIME used". In my case this vulnerability was reported for resources like http://my_site/fonts/fontawesome-webfont....
1
vote
0answers
48 views

Writing an automated browser - is it risky to accept downloads of any mime type?

Background about my app I have a browser macro-recording app built with Selenium. Basically users can use Firefox like normal and record their actions into macros to replay. Question In Selenium, ...
1
vote
1answer
3k views

Secure Image Upload, or Bypassing PHP mime-type Check

When securing image uploads there are basically three approaches I know of (of course, ideally, all three are used): check file extension store uploaded files in non-executable directory outside the ...