[30901] in bugtraq
Re: TEXT/PLAIN: ALERT("OUTLOOK EXPRESS")
daemon@ATHENA.MIT.EDU (Denis Jedig)
Fri Jul 25 16:18:09 2003
Message-ID: <3F21788B.9070204@syneticon.de>
Date: Fri, 25 Jul 2003 20:35:55 +0200
From: Denis Jedig <seclists@syneticon.de>
MIME-Version: 1.0
To: bugtraq@securityfocus.com
In-Reply-To: <200307251742.h6PHgahf028809@web160.megawebservers.com>
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
http-equiv@excite.com wrote:
> Content-Type: text/plain;
> [...]
> <img dynsrc=javascript:alert()><font color=red>foo
>
> The above is a legitimate RFC822 mail message in plain text.
> Ordinarily one would require an html mail message [Content-Type:
> text/html;] to parse html and scripting.
Internet Explorer seems to take no offense on Content-Types either -
text/plain from a web server is happily rendered as HTML, if it contains
valid tags.
Denis Jedig
syneticon GbR
