Re: Spam attack, observations, how to repair
Ralf Schlatterbeck <[email protected]>
| Newsgroups | gmane.comp.bug-tracking.roundup.user |
|---|---|
| Message-ID | <[email protected]> |
On Sat, Jul 05, 2014 at 11:15:04AM +0200, Ralf Schlatterbeck wrote: > What worries me is the guesswork of browsers what they chose to > interpret as html. Looks like a moving target to me. > > Maybe we should add a (configurable) whitelist of allowed mime types > that are *not* rewritten to application/octet-stream when served via the > web interface. > > About your concerns of search engines following links: Do these also > interpret content that is served as application/octet-stream? My > understanding so far was that they don't ... I've tested this a little more. Seems the current fix is not enough. I've set the content type 'xml' in a file in my tracker and it renders as html. Then I used 'wrzlbrmft' and it still rendered. The content-type 'wrzlbrmft/wrzlbrmft' gives me a popup window from the browser that says "you have chosen to open ... filename.htm ... which is HTML document (75 bytes) what should iceweasel do with this file..." When I remove the file extension .htm in the file name it says "... which is wrzlbrmft/wrzlbrmft" instead of "HTML document". Seems the browser is interpreting the file extension too. I guess microsoft browsers will be even more vulnerable to file content guessing by extension... But it *still* renders if I remove the .htm and set the content-type to something arbitrary without a '/'. So the question is if a simple check for the content-type to contain '/' is enough (in addition to the substring check of html) or if we really need a whitelist. And we should probably remove the .html or .htm extension too when serving the link. To get search engines to ignore these links we should mark them with "nofollow". http://en.wikipedia.org/wiki/Nofollow Ralf -- Dr. Ralf Schlatterbeck Tel: +43/2243/26465-16 Open Source Consulting www: http://www.runtux.com Reichergasse 131, A-3411 Weidling email: [email protected] allmenda.com member email: [email protected] ------------------------------------------------------------------------------ Open source business process management suite built on Java and Eclipse Turn processes into business applications with Bonita BPM Community Edition Quickly connect people, data, and systems into organized workflows Winner of BOSSIE, CODIE, OW2 and Gartner awards http://p.sf.net/sfu/Bonitasoft