Re: Spam attack, observations, how to repair

Ralf Schlatterbeck <[email protected]>
Newsgroups gmane.comp.bug-tracking.roundup.user
Message-ID <[email protected]>
On Sat, Jul 05, 2014 at 11:15:04AM +0200, Ralf Schlatterbeck wrote:
> What worries me is the guesswork of browsers what they chose to
> interpret as html. Looks like a moving target to me.
> 
> Maybe we should add a (configurable) whitelist of allowed mime types
> that are *not* rewritten to application/octet-stream when served via the
> web interface.
> 
> About your concerns of search engines following links: Do these also
> interpret content that is served as application/octet-stream? My
> understanding so far was that they don't ...

I've tested this a little more. Seems the current fix is not enough.
I've set the content type 'xml' in a file in my tracker and it renders
as html. Then I used 'wrzlbrmft' and it still rendered. The content-type
'wrzlbrmft/wrzlbrmft' gives me a popup window from the browser that says
"you have chosen to open ... filename.htm ... which is HTML document (75
bytes) what should iceweasel do with this file..."

When I remove the file extension .htm in the file name it says
"... which is wrzlbrmft/wrzlbrmft" instead of "HTML document".

Seems the browser is interpreting the file extension too.
I guess microsoft browsers will be even more vulnerable to file content
guessing by extension...

But it *still* renders if I remove the .htm and set the content-type to
something arbitrary without a '/'.

So the question is if a simple check for the content-type to contain '/'
is enough (in addition to the substring check of html) or if we really
need a whitelist. And we should probably remove the .html or .htm
extension too when serving the link.

To get search engines to ignore these links we should mark them with
"nofollow". http://en.wikipedia.org/wiki/Nofollow

Ralf
-- 
Dr. Ralf Schlatterbeck                  Tel:   +43/2243/26465-16
Open Source Consulting                  www:   http://www.runtux.com
Reichergasse 131, A-3411 Weidling       email: [email protected]
allmenda.com member                     email: [email protected]

------------------------------------------------------------------------------
Open source business process management suite built on Java and Eclipse
Turn processes into business applications with Bonita BPM Community Edition
Quickly connect people, data, and systems into organized workflows
Winner of BOSSIE, CODIE, OW2 and Gartner awards
http://p.sf.net/sfu/Bonitasoft
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.