RE: TXT or HTML? -- IE NEW BUG

[Deirdre Warshall <dwarshall () isaca org>]

Actually, it can get even more convoluted than that.

MSIE 4.0 and 5.0 (possibly 5.01, although I have not personally tested that)
do not recognize the "text/plain" content-type when sent by the web server.
This is a problem long known about by Microsoft, and it's detailed in a
bulletin on their support sites.  

But, in some recent versions of Windows Media Player, somebody did something
*really* stupid. WMP sometimes 'secretly' associates itself to .cgi,
apparently to solve a WMP content-type problem (that problem, although not
the solution they chose, is detailed somewhere on the MS support site too--I
found these bulletins a while ago when originally researching the problem,
and don't have them readily at hand.) 

Which means that if you serve [stated] text/plain files through a .cgi
script to a computer running IE 5.0 + WMP, IE attempts to 'play' the text
file using WMP. If the system's fairly unstable to begin with, either IE or
Windows will crash out of utter confusion.

Having sites which runs under such a configuration, we used to deal with a
couple of complaints a day about the files being inaccessible and/or
crashing IE/Windows. Originally, we provided instructions on how to delete
the association of .cgi to WMP. Then we started recommending an upgrade to
IE 5.5, which cures the text/plain content-type recognition problem.

Then, WebTV 'upgraded' all their users' boxes to a screwy version of IE 4.0
+ WMP (6 months or so back) and another wave of complaints appeared. We
finally came up with another workaround. Apache is willing to treat
file.cgi.txt as a cgi program, and Windows/IE/WebTV executes based upon the
second extension.

D.

-----Original Message-----
From: Magnus Bodin [mailto:magnus () bodin org]
Sent: Sunday, July 29, 2001 6:28 AM
To: Nathan Neulinger
Cc: bugtraq () securityfocus com
Subject: Re: TXT or HTML? -- IE NEW BUG


On Sat, Jul 28, 2001 at 06:56:15PM -0500, Nathan Neulinger wrote:
> > IE doesn't recognize the extensions of files, which
> > may contain some html
> > code.
> > Write a HTML file on NOTEPAD. save it as *.txt.
> > upload to any server.then
>
> It's worse than that - even if you have a cgi script that outputs a
> content-type of "text/plain" - some (all?) version of IE still processes
> the doc as html. (This is a real PITA when using cgi scripts that output
> plain text documents sometimes containing html.)

No. But MSIE will do that if it finds some html-tags in the text.
MSIE is programmed to act as it knows better than the webserver serving the
MIME-header. 

I've put up some test-examples here: http://x42.com/test/mime/

e.g. You cant start a textfile with the word "GIF89a" since it will be
interpreted as a gif-picture. Pure magic-numbers stuff there.

It's a little DWIM (do-what-i-mean) but a little more dumb than the
original Lisp-version in my opinion. 

/magnus

--
::               Magnus Bodin
::::::....               http://x42.com/
::::::::::::::.......................      
teislanorhmcp.>g-dfwvx/0b:y',"5()2168?*49zk