Re: [Evolution] evolution doesn't seem to handle inlined content securely

[Not Zed <notzed ximian com>]

I might also add that this is functionality is absolutely required to
implement html email.  e.g. the introduction email that comes with
evolution.

Its up to the image library to handle it, so yes you could exploit holes
in libjpeg or gdk-pixbuf if they existed.

The alternative is to only allow the display of text ...


On Thu, 2003-08-14 at 14:13, Andreas Wüst wrote:
> Hi
>
> Am I right that evolution doesn't seem to do no better than outlook when
> it comes to inlined data?
>
> If you get an email sporting a line like
>
>       <img src="cid:blablabla">
>
> and attached you get a file with a
>
>       Content-ID: blablabla
>
> string, evolution tries to to display this stuff inline, no?
>
> And since most of these attachements are virus today, the user is no
> better off than an outlook user?!
>
> Please correct me, if this isn't so! But, e.g. what happens, when you
> receive an email with an attachment blabla.scr, and the mime type is
> audio/wav, an this file is inlined by the above tag, then evolution
> tries to view (play) it (of course it's not a wav file, just look at the
> file suffix, it's just some viral code)?
>
> There is obviously no button which you could press to view the
> attachement, since it's getting viewed inline. Is there any way to
> prevent evolution from doing so?