== Ask Yourself Whether

* https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Type[Content-Type] header is not systematically set for all resources.  
* Content of resources can be controlled by users.  

There is a risk if you answered yes to any of those questions.