X-Content-Type-Options header blocks h5p scripts because of wrong MIME type

I have done a few tests to find out more.

Setting define('H5P_DISABLE_AGGREGATION', true); has shown that scripts from the libraries in wp-content/blogs.dir/blogname/files/... get served with wrong headers, while scripts from wp-content/plugins/h5p/... are served correctly.

I run nginx, so there are no .htaccess files inside any directories. I also searched manually just to be sure. My include statement for mime.types in nginx.conf is inside my default server block with root directory set to the root for my wp multisite. I also made sure that mime.types included the entry for javascript.

A general

location ~ .js {
    add_header  Content-Type    application/x-javascript;
}

in the server block did nothing.

cURL
curl -I https://mysite/blogname/files/h5p/libraries/H5P.InteractiveVideo-1.17/di... 2>/dev/null |grep -Fi Content-Type
Content-Type: text/plain

Firefox network monitor

Connection    keep-alive
Content-Length    74358
Content-Security-Policy-Report-Only    default-src 'self' https://sec…a:; report-uri /csp-report.php
Content-Type    text/plain
Date    Tue, 12 Jun 2018 12:15:09 GMT
ETag    "d2c1d2e02f78dfcc6fd2d62054e40277"
Expires    Thu, 12 Aug 2021 22:01:49 GMT
Last-Modified    Mon, 13 Nov 2017 10:59:24 GMT
Referrer-Policy    strict-origin-when-cross-origin
Server    nginx/1.12.2
Strict-Transport-Security    max-age=31536000
X-Frame-Options    SAMEORIGIN
X-Powered-By    PHP/5.4.16
X-XSS-Protection    1; mode=block

I found the problem. My wordpress multisite installation is old and uses the wp-includes/ms-files.php rewrite rule for user files in /blogname/files/. The code in ms-files.php also checks MIME types with wp_check_filetype, which uses get_allowed_mime_types() to get the list of allowed MIME types. And get_allowed_mime_types() unsets javascript if the user doesnt have unfiltered_html allowed.

After modifying get_allowed_mime_types() to not unset javascript for user files the correct MIME types were send. Allowing js for users is not secure, so I should probably remove my ms-files.php dependency.

To pascalCH, maybe you have a similar problem. Because if ms-files.php cant find a MIME type, it does the following:

$mimetype = 'image/' . substr( $file, strrpos( $file, '.' ) + 1 );

header( 'Content-Type: ' . $mimetype );

So you could get "image/js".

Considering that my wp installation was already manually modified before this, I didn't try doing the fix without changing core. I use git with merge to update wordpress. Maybe you could write a plugin which resets the javascript mime type with a hook.

I also tested that users still can't upload js. So it would seem that wp is still secure in that aspect, even with the modification. That means I am leaving things as they are instead of trying to get rid of ms-files.php.

For everyone having problems with ms-files and wanting to get rid of it: https://halfelf.org/2012/dumping-ms-files/
Fair warning, this doesn't seem to be trivial.