Per-content-type rules?

[barbaz]

Just happened upon http://forums.informaction.com/viewtopi ... 578#p38099, and according to that post it should be possible to make ABE rules that only apply to specific content types. However, that isn't working for me. For example,

Code: Select all

Site java-vm@*.*
Deny

doesn't block any Java applets here.
Is this a removed feature? If not, could someone please explain how to use it?

[Giorgio Maone]

Unfortunately that information was incorrect, probably based on confusion between embedded content blocking and ABE, which are separate and very different mechanisms.
More specifically, ABE knows almost nothing about content types, beside hints provided by the loader, and therefore nothing reliable and usable, because ABE blocking happens before the request is initiated, since its intended scope is preventing CSRF: in facts, once the request is sent and the content-type is ultimately known, CSRF already happened.
The syntax in that example has never been implemented, documented or even planned.