RE: [WEB SECURITY] Universal XSS with PDF files: highly dangerous

["Martin O'Neal" <martin.oneal@xxxxxxxxxxxx>]

> "One possible work around on the server side:
> Direct your web server to serve .pdf files as mime type 
> "application/octet" That way the files will be saved to 
> disk instead of opening in the browser plug in."

Firefox works fine with this, but depending upon which version of IE you
have (and which platform it is installed on) this probably wont work by
default, as IE will ignore the MIME type and base it's decision on the
file extension.

Martin...



----------------------------------------------------------------------------
The Web Security Mailing List:
http://www.webappsec.org/lists/websecurity/

The Web Security Mailing List Archives:
http://www.webappsec.org/lists/websecurity/archive/
http://www.webappsec.org/rss/websecurity.rss [RSS Feed]