Vulnerability Development mailing list archives

Unwanted automagic processing (Was: Re: [Q] CORBA, IIOP)


From: mikael.olsson () ENTERNET SE (Mikael Olsson)
Date: Thu, 9 Mar 2000 09:45:21 +0100


Speaking of software doing anwanted automatic processing,
I just saw one member of this list do something I didn't
think was possible.

See this vcard attachment:

Content-Type: text/x-vcard; charset=iso-8859-2; name="simont.vcf"
Content-Transfer-Encoding: 7bit
Content-Description: Card for Simon Tamás
Content-Disposition: attachment; filename="simont.vcf"

begin:vcard
n:Simon;Tamás
tel;cell:3630305510
x-mozilla-html:TRUE
url:www.westel900.hu
org:<IMG SRC="http://users.westel900.net/amk/images/wlogo.gif";>;Special Project
adr:;;Kaposvár str. 5-7;Budapest;;1117;Hungary
version:2.1
email;internet:simont () westel900 hu
title:www sw  engineer
x-mozilla-cpt:;-1
fn:Simon Tamás
end:vcard

Look at the IMG SRC tag.

Why is my nutscrape parsing the vcard contents as HTML? Is this intended behaviour?

I had the idea a while back to implement a mail filter that kills anything looking
like HTML (ie stripping all tags from text/html mime sections), but this example
shows me the futility of that effort. Ack.


--
Mikael Olsson, EnterNet Sweden AB, Box 393, S-891 28 ÖRNSKÖLDSVIK
Phone: +46 (0)660 105 50           Fax: +46 (0)660 122 50
Mobile: +46 (0)70 66 77 636
WWW: http://www.enternet.se        E-mail: mikael.olsson () enternet se



Current thread: