Ensure HTTP headers are applied to the correct Content-Type

[Malvoz]

It was brought to my attention that for example, the CSP header should be sent for other resources such as XML and workers.

(While we could send any given HTTP header in all responses, it'll contribute to header bloat, and for other headers it may even cause issues)

w3c/webappsec#520
webhintio/hint#2342

[LeoColomb]

Well, let's see the conclusions of these issues before concrete action.
I look forward to webhint answer.

[Malvoz]

webhint.io settled on setting CSP for text/html|text/xml|application/xhtml+xml|text/javascript|application/pdf|image/svg+xml in webhintio/hint#2618, because these types are all able to execute scripts within their context (except for JS, but it's the easiest way to set CSP for workers).

So adjusting the pattern to match the types in /media_types/ change text/xml to application/xml.

which results in:
text/html|application/xml|application/xhtml+xml|text/javascript|application/pdf|image/svg+xml

However application/pdf is currently not handled by media_types.conf. Should it be? IMO yes.

[LeoColomb]

OK.

text\/(html|javascript)|application\/pdf|xml

is sufficient or are false positives for other xml relative types undesirable?

[Malvoz]

Covering all cases of XML is certainly better - why not? great!

[LeoColomb]

Alright. Can't wait for your PR! 😉

[LeoColomb]

Closed via #200