Intent to unship: application/http-index-format

[Malte Jürgens]

As of Firefox 124 I intend to remove support for the application/http-index-format content type [1]. This content type is non-standard and not supported by any other browser.

Bug to remove: https://bugzilla.mozilla.org/show_bug.cgi?id=1824325

This content type was "an attempt to provide a generic, extensible file listing format that is principly machine readable." There already have been previous security vulnerabilities in the code for displaying the directory listing, and nowadays, we don't expect sites to use it anymore, as it isn't documented besides the archive linked below [1]. We have not found any sites still using this content type. The content type will still be available for internal pages, such as file:/// or jar: directory listings. Other sites still using the content type will get their content displayed in plain text instead. The existing implementation can still be allowed for all pages by manually setting "network.http_index_format.allowed_schemes" to "*". If you have any concerns, please let me know.

[1] https://www-archive.mozilla.org/projects/netlib/dirindexformat