Lukasz Anforowicz

Graceful fallback for future image types

47

To gracefully handle future image types (e.g. `image/foobar`) would it be desirable to change step 5 from If mimeType's essence is "image/svg+xml", then return true. to If mimeType's essence starts...

Consider an alternative strategy for media that does not rely on media elements directly

8

To allow range responses (206 HTTP status code) ORB remembers URLs of earlier responses that sniffed as audio/video. This works under an assumption that a middle-of-resource range responses are always...

Should ORB block application/javascript with either JSON or JS-parser-breakers

6

There is a difference between CORB and ORB behavior (I've detected the difference when applying CORB tests to an initial implementation of CORB->ORB transition): - Current CORB implementation always (for...

Should ORB block application/signed-exchange responses

1

As spec-ed today, ORB will block `application/signed-exchange` responses. AFAIU this will break some `SignedExchangePrefetchBrowserTest` browser tests in Chromium. I don't know if there is WPT coverage. At any rate, the...

Closes https://github.com/annevk/orb/issues/3 (makes ORB work with future image types) Helps with https://github.com/annevk/orb/issues/29 (only helps if correct MIME types are used) Helps avoid multimedia sniffing step in some cases (e.g. `application/ogg`...

Incentives against using `text/javascript` almost everywhere

1

ORB imposes a performance penalty on incorrectly labelled Javascript responses (e.g. on Javascript served as `text/html`), because body of such mislabeled responses needs to be fully loaded and confirmation-parsed before...

Handling of numbered markdown lists.

10

Fixes issue #5416

CORB confirmation sniffing for HTML, XML and JSON security prefix.

2

Hello @annevk, @csreis, @GPHemsley, This is my attempt to start documenting CORB confirmation sniffing algorithm (as tracked by https://github.com/whatwg/mimesniff/issues/87 and in https://github.com/whatwg/fetch/issues/681#issuecomment-424068323). I hope that this pull request is close...

https://html.spec.whatwg.org/#json-mime-type should cover application/json+*

4

Some HTTP responses use Content-Type set to `application/json+protobuf` (see https://crbug.com/799155). It seems that https://html.spec.whatwg.org/#json-mime-type should cover these responses.

Describe CORB confirmation sniffing

1

Cross-Origin Read Blocking (CORB) confirmation sniffing needs to be described in a spec somewhere (see https://github.com/whatwg/fetch/issues/681#issuecomment-424068323). CORB sniffs response body with the goal of confirming that the body matches the...