@mahryekuh @sukiletxe Fwiw, those event handlers (onxxx) also require specific handling in a Content Security Policy, so yes addEventListener (and a strict, or as-strict-as-possible, CSP) please!

@zachleat https://mimesniff.spec.whatwg.org/#identifying-a-resource-with-an-unknown-mime-type ?