[Esd-l] Double attachment STILL gets through

[John D. Hardin]

On Thu, 15 Nov 2001, Mark Tiramani wrote:

> 
> Content-type: text/plain; charset=US-ASCII
> Content-transfer-encoding: 7BIT
> Content-description: Text from file 'test.bat'
> 

Nowhere in there is a properly encoded filename argument. As far as
MIME is concerned, that's a text attachment.

Outlook is apparently "being helpful" and guessing what the filename
should be from the description comment text.

I am *extremely* reluctant to have the sanitizer start taking stabs at
guessing what text in the MIME headers might possibly be considered
filenames by MUAs that are too smart for their own good. However, we
may be forced into doing so.

--
 John Hardin KA7OHZ   ICQ#15735746   http://www.wolfenet.com/~jhardin/
 jhardin at impsec.org        pgpk -a finger://gonzo.wolfenet.com/jhardin
  768: 0x41EA94F5 - A3 0C 5B C2 EF 0D 2C E5  E9 BF C8 33 A7 A9 CE 76 
 1024: 0xB8732E79 - 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
  In 1998 more than three times as many people in the US were killed
  by incompetent physicians than were killed by handguns, yet the
  President of the A.M.A. is adopting "gun safety" as his platform.
-----------------------------------------------------------------------
   1081 days until the Presidential Election