заметки
content-type and filename extensions for xss
2018-03-05
real content-type
chromium && firefox
text/html
text/xsl
text/xml
application/xml
image/svg+xml
only firefox mozilla
application/mathml+xml
application/rdf+xml
tricks with comma or round bracket
text/html(any
any,text/html
file extensions
chromium && firefox
html
htm
xml
xhtml
svg
svgz
xht
xsl
only firefox
ehtml
shtml
xbl
rdf
xdr