Re: confused about web servers

[Joe <joe@jretrading.com>]

Dave Sherohman wrote:
> Some years ago, I was working on a web-based voicemail/telephony
> interface and discovered that the then-current version of MSIE would
> look at the last portion of retrieved URLs and, if they looked like a
> recognized file extension, it would completely ignore Content-Type and
> attempt to behave based on the extension.  I lost a fair bit of time
> trying to figure out why it kept trying to execute the page returned
> (with Content-Type text/plain!) when I started testing login with an
> email address.  MSIE saw
>
> http://some.server.com/foo?blah=blah&email=bar@baz.com
>
> as a .com file and wanted to treat it accordingly...
>
> I'm pretty sure that's been fixed by now (or at least I really hope it
> has, given the security implications!), but I could see it happening
> again.
Yes, that was the basis of a fair few viruses. E.g. content type: midi 
or wav. Hey, that's a safe file, I'll pass it over to the execution 
handler to play it. The execution handler looks at it, sees a .exe file, 
knows that IE has certified it safe to run and runs it.

Another of those 'what *were* they thinking of?' moments.