[33946] in bugtraq
RE: blocking gzip encoded files
daemon@ATHENA.MIT.EDU (Gervase Markham)
Wed Feb 25 12:34:46 2004
Message-ID: <403B807D.2070402@mozilla.org>
Date: Tue, 24 Feb 2004 16:49:01 +0000
From: Gervase Markham <gerv@mozilla.org>
MIME-Version: 1.0
To: bugtraq@securityfocus.com
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
Darwin Mecham wrote:
> It has recently come to my attention that most browsers happily
> do Accept-encoding: gzip and streaming decompression of
> HTML data received with Content-encoding: gzip
> without asking.
> ...
>
> Is there a way to configure the run-of-the-mill browser to
> block these at the host level ?
You can turn this off in Mozilla by changing the pref
"network.http.accept-encoding", whose default value is "gzip,deflate".
You can set this in "about:config" in recent Mozilla builds, or by
editing prefs.js or user.js in your profile using instructions available
on the web.
This has been in Mozilla since May 2001, and should therefore be
available in Netscape 7.x, Camino, Firefox et al. also.
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/netwerk/protocol/http/src/nsHttpHandler.cpp#927
Gerv
