Re: Detecting attachment types by file extension.. how to change exmh's behaviour?

On Thu, 24 May 2007 16:21:03 +0200, Brian Foster said:

>  I don't know if it is possible to get EXMH to use the
>  filename in the e-mail attachment or not, but I would
>  Strongly Advise against it:  1st, either by accident
>  or deliberately, the name in the attachment may name
>  a file you care about (e.g., /etc/password or .profile
>  or whatever);  and 2nd, not all attachments specify a
>  filename (it's optional).

A while ago, I fixed the code to deal with case 1 (although all I checked
for was "existing file", "begins with .", and "contains shell metacharacters").

There really isn't anything you can do about (2).

And there's a case (3) you missed - "attachement tagged with a filename that
has an extension that conflicts with the actual filetype", and you *really*
don't want to go there.  Anybody who doesn't believe me should go back and
look at how many security bugs Outlook and IE have had, of the form "it will
blindly open a file called FOO.JPG, even if it's actually an executable".

Can somebody test this and let me know what happens (use any old media file
that's not actually a jpg (pdf, wav, mp3, wmp, etc...):

% cp my.media.file.ext /tmp/test.jpg
% open /tmp/test.jpg

and see whether it can deal with mistagged extensions?  And check the
manpage to see if there's a command-line flag to make it do a 'file -i'
sort of check rather than trusting the name?

The *right* fix is to fix the mime-types file to have lots of lines like:

type/foo: /usr/bin/open --check-actual-type %s

If that's not feasible, and people think it's worth fixing, we should fix
the exmh code to do a 'file -i' and use that to help name the /tmp/...exmh
files in preference to whatever claimed filename the attachment showed up with.

_______________________________________________
Exmh-users mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/exmh-users

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)
Comment: Exmh version 2.5 07/13/2001

iD8DBQFGVaT8cC3lWbTT17ARArwfAJ9uea5/seBy+CtFMdKl6zv1mb4IqgCfX+73
aVVn2qsffGic3dB784+1g3Y=
=ZAGV
-----END PGP SIGNATURE-----