Vulnerability Development: Re: Plain text files in internet explorer

[Magnus Bodin <magnus () bodin org>]

On Sat, Aug 31, 2002 at 07:54:16AM -0400, John Hennessy wrote:
> Is it just me or is impossible to have plain text in internet explorer?
> http://www.charm.net/~johnh/annoying.txt
>
> If I make a text file and put it on my webserver, and put in a few lines
> of text and then basicly anything in <>'s internet explorer will read it
> as HTML.
>
> Grrrrr is all I have to say about that.
Internet Explorer decides for itself whether the sent Content-type heading
is "correct" or needs to be "re-thought". 

It has been a known "feature" of explorer since a long time ago;
see my testpage at 

http://x42.com/test/mime/

You e.g. can use this knowledge to send javascript as "image/gif" through
firewalls that "block" evil content-types.

/magnus

-- 
http://x42.com/