Vulnerability Development mailing list archives

Re: Unwanted automagic processing (Was: Re: [Q] CORBA, IIOP)


From: nicolas.justin () FREE FR (Nicolas Justin)
Date: Fri, 10 Mar 2000 23:41:42 +0100


Mikael Olsson wrote :

Speaking of software doing anwanted automatic processing,
I just saw one member of this list do something I didn't
think was possible.

See this vcard attachment:

Content-Type: text/x-vcard; charset=iso-8859-2; name="simont.vcf"
Content-Transfer-Encoding: 7bit
Content-Description: Card for Simon Tamás
Content-Disposition: attachment; filename="simont.vcf"

begin:vcard
n:Simon;Tamás
tel;cell:3630305510
x-mozilla-html:TRUE
url:www.westel900.hu
org:<IMG SRC="http://users.westel900.net/amk/images/wlogo.gif";>;Special Project
adr:;;Kaposvár str. 5-7;Budapest;;1117;Hungary
version:2.1
email;internet:simont () westel900 hu
title:www sw  engineer
x-mozilla-cpt:;-1
fn:Simon Tamás
end:vcard

Look at the IMG SRC tag.

Why is my nutscrape parsing the vcard contents as HTML? Is this intended behaviour?

I had the idea a while back to implement a mail filter that kills anything looking
like HTML (ie stripping all tags from text/html mime sections), but this example
shows me the futility of that effort. Ack.

--
Mikael Olsson, EnterNet Sweden AB, Box 393, S-891 28 ÖRNSKÖLDSVIK
Phone: +46 (0)660 105 50           Fax: +46 (0)660 122 50
Mobile: +46 (0)70 66 77 636
WWW: http://www.enternet.se        E-mail: mikael.olsson () enternet se

Add this lines to your procmailrc
  :0
  * ^Content-Type.*text/html*
  | (formail -r ; echo "You have sent a mail in HTML format, please
resend it in plain text format") | /usr/sbin/sendmail -oi -t
  :0
  * ^Content-Type.*multipart/alternative*
  | (formail -r ; echo "You have sent a mail in HTML format, please
resend it in plain text format") | /usr/sbin/sendmail -oi -t

So, if you receive a mail in HTML format, it will be trashed and a mail
will be sent to the sender.

--
____________________________________________
Nicolas Justin  -  nicolas.justin () free fr
http://surf.to/linux-fr



Current thread: