When a Handler does not explicitly set the Content-Type header, both
CGI implementations default to “text/html”. If an attacker can make
a server generate content under their control (e.g. a JSON
containing user data or an uploaded image file) this might be
mistakenly returned by the server as “text/html”. If a victim visits
such a page they could get the attacker's code executed in the
context of the server origin. If an attacker can make a server
generate content under their control (e.g. a JSON containing user
data or an uploaded image file) this might be mistakenly returned by
the server as “text/html”. If a victim visits such a page they could
get the attacker's code executed in the context of the server
origin.