Re: [Evolution] evolution doesn't seem to handle inlined content securely

[Jeffrey Stedfast <fejj ximian com>]

On Thu, 2003-08-14 at 14:13, Andreas Wüst wrote:
> Hi
>
> Am I right that evolution doesn't seem to do no better than outlook when
> it comes to inlined data?
>
> If you get an email sporting a line like
>
>       <img src="cid:blablabla">
>
> and attached you get a file with a
>
>       Content-ID: blablabla
>
> string, evolution tries to to display this stuff inline, no?

yes and no...

> And since most of these attachements are virus today, the user is no
> better off than an outlook user?!
>
> Please correct me, if this isn't so! But, e.g. what happens, when you
> receive an email with an attachment blabla.scr, and the mime type is
> audio/wav, an this file is inlined by the above tag, then evolution
> tries to view (play) it (of course it's not a wav file, just look at the
> file suffix, it's just some viral code)?

well, since the attachment won't be able to load as an image file,
nothing will happen. you'll get an iframe box or something with nothing
in it.

> There is obviously no button which you could press to view the
> attachement, since it's getting viewed inline. Is there any way to
> prevent evolution from doing so?

evolution will ONLY display stuff inline if it:

1. has a builtin handler (which is basically limited to image handlers
and vcard/ical stuff - ie stuff that is "safe". as with all things, it's
possible that the data may cause gtk's image loading code to crash or
evo's addressbook/calendar control code to crash...)

2. or if you:
  a) have a bonobo control capable of handling the specified mime type

and

  b) configured your MIME-types & Applications control centre crapplet
to use this bonobo control for viewing these types

and

  c) EXPLICTLY allow Evolution to use bonobo-controls of for this
mime-type (which is only configurable via gconf - there is no UI for
this so you have to be a bit of a hacker to find/set it in the first
place)

So as far as I'm aware, Evolution is a LOT safer than Outlook in this
reguard. If you find logic mistakes in our reasoning, please let us
know.

-- 
Jeffrey Stedfast
Evolution Hacker - Ximian, Inc.
fejj ximian com  - www.ximian.com