Re: Detecting attachment types by file extension.. how to change exmh's behaviour?

>And there's a case (3) you missed - attachement tagged with a filename that
>has an extension that conflicts with the actual filetype, and you *really*
>don't want to go there.  Anybody who doesn't believe me should go back and
>look at how many security bugs Outlook and IE have had, of the form "it will
>blindly open a file called FOO.JPG, even if it's actually an executable"

I believe you've got the case inverted ... the MIME type was "image/jpeg",
but the filename was "FOO.EXE".  Of course, that still applies here, since
extensions would be the determining case.

>Can somebody test this and let me know what happens (use any old media file
>that's not actually a jpg (pdf, wav, mp3, wmp, etc...):
>
>% cp my.media.file.ext /tmp/test.jpg
>% open /tmp/test.jpg
>
>and see whether it can deal with mistagged extensions?

Well, it tries to open it with the image application (Preview) and
fails to do so.  That's expected.

>And check the
>manpage to see if there's a command-line flag to make it do a 'file -i'
>sort of check rather than trusting the name?

No, that doesn't exist.  The best you get is a "-a" flag where you
explicitly give it the application to use.

What open does is the same thing that happens when you double-click on
a file in the MacOS GUI.  The concept of looking into a file's contents
to see what kind of file you have is simply foreign to MacOS X (I'm not
interested in debating the merits of this approach; I am simply stating
a fact).

>If that's not feasible, and people think it's worth fixing, we should fix
>the exmh code to do a 'file -i' and use that to help name the /tmp/...exmh
>files in preference to whatever claimed filename the attachment showed up with.

It occurs to me that what you want is to open the correct application based
on the MIME type.  Perhaps the right solution is to have a list of mime-types
and extensions to use with them?  That way when you get an image/jpeg, exmh
knows to create a /tmp/...exmh.jpg file.

--Ken