On 3 Jun 2016, at 1:05, Kees Theunissen wrote:
.html and .htm are not listed as "bad extensions" in the
"suggested-minimum-filter-for-windows-clients" script in the
MIMEDefang
download. But obviously .html and .htm _ARE_ dangerous.
Well, yes. Some of us have been trying to convince the instigators of
HTML in email of this fact for over 20 years to no avail.
Unfortunately, many of the most popular tools for composing and
submitting email (a.k.a. MUA -> Mail User Agent) generate HTML parts by
default and some have no configuration that will make them always send
pure plain text email. Usually the HTML is in nameless alternatives
inside a multipart/alternative message, but sometimes even those get
pointless names and there are MUAs which do a wide variety of strange
and unexpected things when forwarding messages or replying with the
inclusion of an original message, so shunning HTML based on filename
extension is Not Safe. On the other hand, it has been many years since
the current or most common versions of popular MUAs which can interpret
HTML mail will execute embedded scripts. Of course that can't stop users
from being shown an HTML attachment as a PDF because of a crappy MUA,
saving it, and opening it with a double-click into a browser that will
run those scripts. Obfuscated JavaScript in spam is the current favorite
initial vector for ransom-ware infections, so you can't just do nothing.
The MIMEDefang solution for this isn't to add htm and html to the list
of bad extensions, as that would reject substantial legitimate mail at
most sites. Most sites also certainly can't reject all mail with
text/html parts, as that would be most mail for most sites. For many
sites, stripping out HTML parts (which MD can do) also would be
unacceptable to users. HTML in email always has been a bad idea, but it
is a bad idea which has become entrenched as normalcy.
What most systems using MD can (and SHOULD) do is to add a block of code
analogous to the existing bad extension check in the example script that
checks for filenames with multiple "extensions" where the last one is
not a recognizable archival or compression format. For example: reject
*.pdf.html, *.htm.pdf, or *.docx.doc but not *.tar.gz, *.cpio.bz2, or
*.files.7z. You can also reject mail with (.htm or .html names OR
"Content-Type: text/html") and "Content-Disposition: attachment" but be
prepared for that to hit some innocent messages.
_______________________________________________
NOTE: If there is a disclaimer or other legal boilerplate in the above
message, it is NULL AND VOID. You may ignore it.
Visit http://www.mimedefang.org and http://www.roaringpenguin.com
MIMEDefang mailing list [email protected]
http://lists.roaringpenguin.com/mailman/listinfo/mimedefang
