def test_change_response_class_to_text():
    mw = _get_mw()
    req = SplashRequest('http://example.com/', magic_response=True)
    req = mw.process_request(req, None)
    # Such response can come when downloading a file,
    # or returning splash:html(): the headers say it's binary,
    # but it can be decoded so it becomes a TextResponse.
    resp = TextResponse('http://mysplash.example.com/execute',
                        headers={b'Content-Type': b'application/pdf'},
                        body=b'ascii binary data',
                        encoding='utf-8')
    resp2 = mw.process_response(req, resp, None)
    assert isinstance(resp2, TextResponse)
    assert resp2.url == 'http://example.com/'
    assert resp2.headers == {b'Content-Type': [b'application/pdf']}
    assert resp2.body == b'ascii binary data'
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.