logo       

Re: TEXT/PLAIN: ALERT("OUTLOOK EXPRESS"): msg#00386

security.bugtraq

Subject: Re: TEXT/PLAIN: ALERT("OUTLOOK EXPRESS")

http-equiv@xxxxxxxxxx wrote:
Content-Type: text/plain;
[...]
<img dynsrc=javascript:alert()><font color=red>foo

The above is a legitimate RFC822 mail message in plain text. Ordinarily one would require an html mail message [Content-Type: text/html;] to parse html and scripting.

Internet Explorer seems to take no offense on Content-Types either - text/plain from a web server is happily rendered as HTML, if it contains valid tags.

Denis Jedig
syneticon GbR




<Prev in Thread] Current Thread [Next in Thread>
Google Custom Search

News | FAQ | advertise