To be able to block more "no-cors" cross-origin responses from entering the content process it would be good to know what we currently handle as images.

I'm pretty sure we look at Content-Type for image/svg+xml and the decoding process looks at the initial set of bytes of a response. Is this fully documented somewhere?

https://mimesniff.spec.whatwg.org/#matching-an-image-type-pattern covers this. Might that be all?

(Not sure if ImageLib is appropriate. Sorry if it's not.)

(In reply to Anne (:annevk) from comment #0)

https://mimesniff.spec.whatwg.org/#matching-an-image-type-pattern covers this. Might that be all?

It seems that https://searchfox.org/mozilla-central/rev/c7cf087b6e1384608ca3989f042f12f7cabd0a5f/image/imgLoader.cpp#2717-2797 is the code for that.

Hi Tom, I'd like to help on this bug. However I don't seem to understand what we'd like to do here. Is the task here to validate the code you linked in comment 1 with https://mimesniff.spec.whatwg.org/#matching-an-image-type-pattern? It'd be great if you can give me some pointers. Thanks!

Redirect a needinfo that is pending on an inactive user to the triage owner.
:aosmond, since the bug has recent activity, could you have a look please?

For more information, please visit auto_nag documentation.

The DOM team has talked about this and clarified my question. So no needinfo is needed.