Code: bool SniffMimeType(const char* content,
                   size_t content_size,
                   const GURL& url,
                   const std::string& type_hint,
                   std::string* result) {
  DCHECK_LT(content_size, 1000000U);  // sanity check
  DCHECK(content);
  DCHECK(result);

  bool have_enough_content = true;

  result->assign(type_hint);

  if (IsOfficeType(type_hint))
    return SniffForInvalidOfficeDocs(content, content_size, url, result);

   const bool hint_is_unknown_mime_type = IsUnknownMimeType(type_hint);
 
  if (hint_is_unknown_mime_type && !url.SchemeIsFile() &&
      SniffForHTML(content, content_size, &have_enough_content, result)) {
    return true;
   }
 
  const bool hint_is_text_plain = (type_hint == "text/plain");
  if (hint_is_unknown_mime_type || hint_is_text_plain) {
    if (!SniffBinary(content, content_size, &have_enough_content, result)) {
      if (hint_is_text_plain) {
        return have_enough_content;
      }
    }
  }

  if (type_hint == "text/xml" || type_hint == "application/xml") {
    if (SniffXML(content, content_size, &have_enough_content, result))
      return true;
    return have_enough_content;
  }

  if (SniffCRX(content, content_size, url, type_hint,
               &have_enough_content, result))
    return true;

  if (SniffForOfficeDocs(content, content_size, url,
                         &have_enough_content, result))
    return true;  // We've matched a magic number.  No more content needed.

  if (type_hint == "application/octet-stream")
    return have_enough_content;

  if (SniffForMagicNumbers(content, content_size,
                           &have_enough_content, result))
    return true;  // We've matched a magic number.  No more content needed.

  return have_enough_content;
}

Vulnerability Type: 
CWE ID: 
Summary: Parsing documents as HTML in Downloads in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to cause Chrome to execute scripts via a local non-HTML page.
Commit Message: Revert "Don't sniff HTML from documents delivered via the file protocol"

This reverts commit 3519e867dc606437f804561f889d7ed95b95876a.

Reason for revert: crbug.com/786150. Application compatibility for Android WebView applications means we need to allow sniffing on that platform. 

Original change's description:
> Don't sniff HTML from documents delivered via the file protocol
> 
> To reduce attack surface, Chrome should not MIME-sniff to text/html for
> any document delivered via the file protocol. This change only impacts
> the file protocol (documents served via HTTP/HTTPS/etc are unaffected).
> 
> Bug: 777737
> Cq-Include-Trybots: master.tryserver.chromium.android:android_cronet_tester;master.tryserver.chromium.mac:ios-simulator-cronet
> Change-Id: I7086454356b8d2d092be9e1bca0f5ff6dd3b62c0
> Reviewed-on: https://chromium-review.googlesource.com/751402
> Reviewed-by: Ben Wells <benwells@chromium.org>
> Reviewed-by: Sylvain Defresne <sdefresne@chromium.org>
> Reviewed-by: Achuith Bhandarkar <achuith@chromium.org>
> Reviewed-by: Asanka Herath <asanka@chromium.org>
> Reviewed-by: Matt Menke <mmenke@chromium.org>
> Commit-Queue: Eric Lawrence <elawrence@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#514372}

TBR=achuith@chromium.org,benwells@chromium.org,mmenke@chromium.org,sdefresne@chromium.org,asanka@chromium.org,elawrence@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: 777737
Change-Id: I864ae060ce3277d41ea257ae75e0b80c51f3ea98
Cq-Include-Trybots: master.tryserver.chromium.android:android_cronet_tester;master.tryserver.chromium.mac:ios-simulator-cronet
Reviewed-on: https://chromium-review.googlesource.com/790790
Reviewed-by: Eric Lawrence <elawrence@chromium.org>
Reviewed-by: Matt Menke <mmenke@chromium.org>
Commit-Queue: Eric Lawrence <elawrence@chromium.org>
Cr-Commit-Position: refs/heads/master@{#519347}