WebKit export of https://bugs.webkit.org/show_bug.cgi?id=297161

[nt1m]

WebKit export from bug: JSON & XML MIME types should only contain valid HTTP tokens

[wpt-pr-bot]

This patch has been exported from WebKit; it will be approved automatically once the downstream patch is r+.

[nt1m]

@chrishtr @foolip Could you sign off on this change from the Chromium side?

While fixing the only WebKit failure in this test, I found other bugs, and wrote tests for them. Chromium seems to share some of these bugs as well. Firefox passes all the tests written here.

This would bring Chrome's "Modules" score from 100% to ~98.5%, but the failures are fairly straightforward to fix, it would just be checking that the mime type only uses valid HTTP tokens on both sides of the / in the mime type.

See https://mimesniff.spec.whatwg.org/#parse-a-mime-type

[nt1m]

cc @jgraham @allstarschh for Gecko, although Gecko already passes those tests.

[wpt-pr-bot]

The review process for this patch is being conducted in the WebKit project.

[foolip]

@nt1m the change itself seems straightforward, but does it affect anything other than Modules? Is there any web compat risk, things that would previously work but now would not?

[nt1m]

@nt1m the change itself seems straightforward, but does it affect anything other than Modules? Is there any web compat risk, things that would previously work but now would not?

The JSON change only affects modules and Web Inspector (not web-exposed) in WebKit (based on code-analysis). The XML change isn't covered by this WPT PR, but covers what gets detected as an XML document when loading one in-page and in XHR.

Gecko has shipped correct mimetype parsing for a while, and this change is limited to mimetypes with a suffix (e.g. +json and +xml) where we make sure every part is a valid token, so unless people use really funky mimetypes, I doubt there will be much breakage. Either way, this PR only adds the tests for JSON modules.

[foolip]

Thanks for the details @nt1m, sounds like it should be fine.

Microsoft is driving the Modules focus area of Interop 2025, so I'd like to hear from them too to avoid surprises. @dandclark can you take a look?

[dandclark]

Sorry for the delay, we're looking at this. There's a question of how feasible/reasonable it is to limit this stricter checking to just +json MIME types, or if it should be applied more widely. Not sure yet about the compat impact of applying it out to all wildcard MIME type checks. I'll be back with our answer soon.

[dandclark]

On further review this is fine from our side.

[nt1m]

Thanks! will merge it