Re: Is this exploitable?..

[Peter Conrad <conrad () tivano de>]

Hi,

On Thu, Dec 16, 2004 at 12:14:11PM -0800, Benjamin Livshits wrote:
> What worries me is a scenario in which parts of the HTTP request are
> somehow malicious. I.e. as is the case for XSS, if responseString is set
> to contain some user-supplied JavaScript, it may lead to problems if
> printed back to the browser verbatim.

that's why

> resp.setContentType("message/http");

Standard-conforming browsers will not interpret JavaScript (or other active
content) inside "message/http" bodies.

Of course, certain broken browsers ignore the ContentType header and
instead try to guess what the content type "really" is. That's a browser
bug, though, and even if it was exploitable you couldn't blame it on
the server.

Bye,
        Peter
-- 
Peter Conrad                        Tel: +49 6102 / 80 99 072
[ t]ivano Software GmbH             Fax: +49 6102 / 80 99 071
Bahnhofstr. 18                      http://www.tivano.de/
63263 Neu-Isenburg

Germany