Web Security Research

Content Sniffing

Signatures

This page contains the mime signatures used by Internet Explorer 7, Firefox 3, Safari 3.1, Google Chrome, and the HTML 5 specification. You can view these signatures by browser, which will display the signatures for each mime type used that browser, or by mime type, which will display the signatures for each browser for that mime type. We use a precise nomenclature to describe the mime signatures, which is described below.

or

Nomenclature

DATA is a pointer to a buffer containing the first bytes of the file. Different browsers use different size buffers:

DATA[0:3] represents the DATA substring starting at offset 0 up to offset 3 (both inclusive). Thus, DATA[0:3] is the substring of DATA of length 4 starting at offset 0. We also use common C string library functions as part of our signatures. To simplify notation, we introduce a case insensitive version of strstr, which is not available in the C library:

Some signatures uses PTR, which is a pointer to the first non-whitespace character in the DATA buffer. In other words, all the bytes between DATA (inclusive) and PTR (not inclusive) are ASCII whitespace. The whitespace characters are: