Re: Plain text files in internet explorer

[Dan Kaminsky <dan () doxpara com>]

> Is this actually specified someplace in some relevant RFC?  I can't 
> comment on application/octet-stream, but I've never before heard that 
> text/plain was ambiguous.  I thought it was crystal-clear and meant, 
> well, "plain text" [basically a sequence of characters in whatever 
> charset is specified].
>
> Is this interpretation some idiosyncracy of Microsoft's or is it actually 
> an RFC-supported 'correct' interpretation of the text/plain MIME type?
>  
Mozilla will occasionally render downloads from a scripted backend as 
plain text.  It's really pretty annoying, correct behavior or not.

All things being equal, I'll go with correct behavior being first that 
which matches what is presented to the user in the title bar, using 
standard (Microsoftian!) in-band filename notation, then if nothing 
usable is there, use the MIME-type as a hint.  In such a circumstance:

foobar.txt is always read as text.
foobar.html is always read as html.
foobar.php and foobar.php, which really *should* be foobar.html because 
-- dear god, they contain html -- can use the MIME-type to hint 
themselves into HTML parsing.
foobar.gif is always read as gif.
a javascript virus is always obviously either javascript(foo.js) or 
parsed as a gif(foo.gif).

Importantly, I cannot concieve of a circumstance in which this can be 
described incorrect behavior.  None.  A link to foo.gif parsed as a 
Shockwave Flash executable is *always* misparsed, because the user chose 
to view the previous format, not the latter.  GIFs can't exploit your 
system.  Flash files can, just like any executable.

We're seeing a reasonably steady stream of "x posing as y to get around 
z restriction" attacks made available specifically because filetype 
handling is being hidden behind a user-opaque format standard that 
places the type of a file far outside the file itself.

I expect the exploit stream will eventually lead to MIME-type 
deprecation.  But then, I also expect websites to stop exposing such an 
amazing amount of their database backend in their user-visible URLs, so 
maybe I'm being uncharacteristically optimistic.

Yours Truly,

   Dan Kaminsky
   DoxPara Research
   http://www.doxpara.com