Problem

The FileDownloadController serves files for Drupal's private file system. It issues a Symfony BinaryFileResponse when a file is allowed to be retrieved. During preparation of this response, it utilizes Symfony's MIME type guesser to set the Contenty-Type header. By default, Symfony adds a couple of guessers, but as part of prehandling the response in DrupalKernel, Drupal registers it's own ExtensionMimeTypeGuesser that, like the name suggests, guesses the MIME type based on the extension.

Prior to Symfony 4.3, the MIME guesser was included as part of the Http Foundation component. As part of Symfony 4.3, a new dedicated MIME component was added and the old pieces in Http Foundation were deprecated. So now the problem: at this point, the BinaryFileResponse was also moved to using the new MIME component for guessing, but Drupal is still registering it's extension-based guesser with the deprecated MIME guesser mechanism. As a result, Drupal's guesser is no longer being invoked when private files are downloaded and you can get some weird results from the default Symfony guessers that cause a CSS file to be classified as an assembly file (for instance).

Steps to reproduce

  1. Add a CSS file with a rule like .globl-item { display: none; } to the private file system.
  2. Download the file and notice the content type is text/x-asm instead of the expected text/css

Comments

kevin.dutra created an issue. See original summary.

kevin.dutra’s picture

Assigned: kevin.dutra » Unassigned
Status: Active » Needs review
StatusFileSize
new1.4 KB

Here's the basic gist of the fix.

Status: Needs review » Needs work

The last submitted patch, 2: 3262305-2.patch, failed testing. View results

kevin.dutra’s picture

Status: Needs work » Needs review
StatusFileSize
new5.24 KB

And here's round 2, with adjustments to accommodate tests. :)

kevin.dutra’s picture

StatusFileSize
new4.31 KB

Oops, forgot the interdiff. Better late than never!

Version: 9.3.x-dev » 9.4.x-dev

Drupal 9.3.15 was released on June 1st, 2022 and is the final full bugfix release for the Drupal 9.3.x series. Drupal 9.3.x will not receive any further development aside from security fixes. Drupal 9 bug reports should be targeted for the 9.4.x-dev branch from now on, and new development or disruptive changes should be targeted for the 9.5.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.4.x-dev » 9.5.x-dev

Drupal 9.4.9 was released on December 7, 2022 and is the final full bugfix release for the Drupal 9.4.x series. Drupal 9.4.x will not receive any further development aside from security fixes. Drupal 9 bug reports should be targeted for the 9.5.x-dev branch from now on, and new development or disruptive changes should be targeted for the 10.1.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

smustgrave’s picture

Status: Needs review » Needs work
Issue tags: +Needs Review Queue Initiative, +Needs issue summary update

This issue is being reviewed by the kind folks in Slack, #needs-review-queue-initiative. We are working to keep the size of Needs Review queue [2700+ issues] to around 400 (1 month or less), following Review a patch or merge request as a guide.

This could use an issue summary update using the default template. Mainly proposed solution and remaining tasks.

scambler’s picture

I was getting this error: Refused to execute script from '...' because its MIME type ('text/plain') is not executable, and strict MIME type checking is enabled.

This was on a .js file using the private file system. After applying patch #4, this is now getting the correct mime type and working as expected.

Drupal version: 9.5.3

Thanks @kevin.dutra

Version: 9.5.x-dev » 11.x-dev

Drupal core is moving towards using a “main” branch. As an interim step, a new 11.x branch has been opened, as Drupal.org infrastructure cannot currently fully support a branch named main. New developments and disruptive changes should now be targeted for the 11.x branch. For more information, see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

mohit_aghera’s picture

Status: Needs work » Closed (duplicate)
Issue tags: +Bug Smash Initiative
Related issues: +#3172550: Register Drupal's mime type guesser the Symfony MimeTypes service

I came across this issue while doing bugsmash triage.

It seems, this is already fixed as part of #3172550: Register Drupal's mime type guesser the Symfony MimeTypes service.
Please re-open if you notice further issues.