108186 - Mailnews should use file extension in order to open application/octet-stream attachments

Status: VERIFIED WONTFIX

(SeaMonkey :: MailNews: Message Display, defect)

Description

[Francisco León]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:0.9.5+) Gecko/20011101
BuildID:    2001110121

I got a mail with a picture of a girl in it. Mozilla does not display it, but if
i save it i can view it with any image viewer

Reproducible: Always
Steps to Reproduce:
1.Get a girl to send you a picture that mozilla does not understand
2.Hope that she is not ugly


Actual Results:  Mozilla cant display the jpg. Come on, she is not that ugly

Expected Results:  Mozilla already shows uglier stuff

Comment 1

[Francisco León]

Attachment: Scary jpg that mozilla does not display in mail

Comment 2

[Francisco León]

?? The image shows!
The image shows, so it must be some other problem. I bet mozilla is using
another header rather than trying to use image/jpeg

Comment 3

[Francisco León]

No wonder mozilla does not like the picture

Content-Type: application/octet-stream; name="foto 2.JPG"
Content-Transfer-Encoding: base64
Mime-Version: 1.0

Spanish web based email service latinmail.com is the culprit.

Why does mozilla rely so heavily on the header and not on the file extension?
Security? Reliability? Speed?

Should this go to evangelism?

Comment 4

[Toby Haynes]

I don't think this is just an evangelism problem - Mozilla should error
gracefully if the image can't be displayed or there is an error in image
conversion. This bug sounds very similar to one I have experienced recently with
some mail received in Moz.

Comment 5

[Francisco León]

Yes, so there are actually 2 problems in this bug
1) Mozilla fails to announce that it cannot display the image
2) Mozilla does not care for file extension, rather uses the header of the file
that is included in the mail. This is a BIG SECURITY HOLE, because probably if i
send a file called "something.jpg" and is encoded as a binary file, it could be
executed. I take it that mozilla isn't foolish enough to open a binary file
without asking, but since i use linux i dont know
Nominating for mozilla 0.9.7

Comment 6

[Boris Zbarsky [:bzbarsky]]

> Why does mozilla rely so heavily on the header and not on the file extension?

Because that's the only reliable way to tell the type.  An extension is not it.
 The relevant specs are very clear -- when a type is given it MUST be used.  No
exceptions.

> his is a BIG SECURITY HOLE, because probably if i send a file called
> "something.jpg" and is encoded as a binary file, it could be
> executed.

No it would not.  The mime types that correspond to binary files are
special-cased to make sure that we prompt users before executing anything.

This is a mailnews bug if it is a bug at all.  Mailnews should consider sniffing
the file extension in the case of application/octet-stream.

Comment 7

[Sterling Bates]

I would think that it's pointless to try making Mozilla file extension-aware 
for all file types, so this bug would better lie in latinmail.com's bug list.  
Besides, I could see this becoming a lot like dual inheritance in CSS -- which 
one takes greater precedence, the mime type or the file extension?  (Sorry, 
couldn't come up with a better analogy :)

Comment 8

[Francisco León]

I second Boris´idea. As i discovered, this is really a latinmail bug, but 
perhaps we can make mozilla smarter around this.

Comment 9

[scottputterman]

rassigning to ducarroz

Comment 10

[scottputterman]

marking wontfix.  JF, please reopen if you think there's something we could or
should do.

Comment 11

[Trix Supremo]

marking verified

Comment 12

[Mike Cowperthwaite]

*** Bug 244520 has been marked as a duplicate of this bug. ***

Comment 13

[Mike Cowperthwaite]

*** Bug 261156 has been marked as a duplicate of this bug. ***

Comment 14

[Frankie]

*** Bug 267047 has been marked as a duplicate of this bug. ***