Re: Detecting attachment types by file extension.. how to change exmh's behaviour?

On Thu, 24 May 2007 11:44:11 EDT, Ken Hornstein said:
> >And there's a case (3) you missed - attachement tagged with a filename that
> >has an extension that conflicts with the actual filetype, and you *really*
> >don't want to go there.  Anybody who doesn't believe me should go back and
> >look at how many security bugs Outlook and IE have had, of the form "it will
> >blindly open a file called FOO.JPG, even if it's actually an executable"
> 
> I believe you've got the case inverted ... the MIME type was "image/jpeg",
> but the filename was "FOO.EXE".  Of course, that still applies here, since
> extensions would be the determining case.

They've actually had multiple security bugs of that sort, in *both*
directions.


> >If that's not feasible, and people think it's worth fixing, we should fix
> >the exmh code to do a 'file -i' and use that to help name the /tmp/...exmh
> >files in preference to whatever claimed filename the attachment showed up with.
> 
> It occurs to me that what you want is to open the correct application based
> on the MIME type.  Perhaps the right solution is to have a list of mime-types
> and extensions to use with them?  That way when you get an image/jpeg, exmh
> knows to create a /tmp/...exmh.jpg file.

Right, you want to have a lookup table of type -> extension.  I'm not clear
what we should take preference on - the claimed mime/type that's in the
headers, or what 'file --mime' says the file *really* is.  Most of the time,
the two agree and it's not an issue.  And the MIME spec implies you should
tryst the MIME headers.  However, there's two major classes of corner case:

1) A *lot* of borked MUA software will send you a perfectly good JPG file,
and tag it as "application/octet-stream", so you end up having to save the
file and then open it manually.  Actually testing the file fixes this...

2) Testing the file however *breaks* if the MIME headers were in fact
correct, but 'file --mime' guesses wrong.  For instance, I've had people who
intentionally shipped me known corrupted image files, and tagged them as
application/octet-stream specifically so they wouldn't get opened by default
and crash the image viewer....

_______________________________________________
Exmh-users mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/exmh-users

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)
Comment: Exmh version 2.5 07/13/2001

iD8DBQFGVbZ1cC3lWbTT17ARAnvfAKDwJHaK5qUOmOvbCJrSY3zDP0q0FACgm2Zi
s9dBAX0LUkhNs/E+gaStGeU=
=ZFGr
-----END PGP SIGNATURE-----