Bugtraq: Re: TEXT/PLAIN: ALERT("OUTLOOK EXPRESS")

[Denis Jedig <seclists () syneticon de>]

http-equiv () excite com wrote:
> Content-Type: text/plain;
> [...]
> <img dynsrc=javascript:alert()><font color=red>foo
>
> The above is a legitimate RFC822 mail message in plain text. 
> Ordinarily one would require an html mail message [Content-Type: 
> text/html;] to parse html and scripting. 
Internet Explorer seems to take no offense on Content-Types either - 
text/plain from a web server is happily rendered as HTML, if it contains 
valid tags.
Denis Jedig
syneticon GbR