Check Content-Type header before parsing AJAX response as HTML (#8649)

Fix for issue #8640 (possible XSS vulnerability)

Author: dryabov

js/widgets/pagecontainer.js

@@ -564,6 +564,15 @@ $.widget( "mobile.pagecontainer", {
 
 		return $.proxy( function( html, textStatus, xhr ) {
 
+			// Check that Content-Type is "text/html" (https://github.com/jquery/jquery-mobile/issues/8640)
+			if ( !/^text\/html\b/.test( xhr.getResponseHeader('Content-Type') ) ) {
+				// Display error message for unsupported content type
+				if ( settings.showLoadMsg ) {
+					this._showError();
+				}
+				return;
+			}
+
 			// Pre-parse html to check for a data-url, use it as the new fileUrl, base path, etc
 			var content,