172883 - Plain text email rendered as HTML

Status: VERIFIED DUPLICATE of bug 172808

(SeaMonkey :: MailNews: Message Display, defect)

Description

[Gervase Markham [:gerv]]

If you are sent an email without a Content-Type (I believe that's the trigger
condition), any HTML within it is rendered, independent of your View | Message
Body As settings. If you have JS turned on for Mail/News, it is executed.
Presumably this is because Mozilla is merely wrapping the entire text in
HTML/BODY/PRE tags.

Bugzilla email is an example of this.

Here's a demonstration. First, a script. Remember to turn on scripting in Mail
and News, and View Source first to make sure I'm not stealing your cookies :-)

<script>alert("Oh, dear");</script>

Now a select widget:
<select name="wibble">
  <option name="foo">Foo</option>
  <option name="bar">Bar</option>
</select>

Possibly related: bug 172784.

I've marked this bug security-sensitive in case there are further ramifications
I haven't discovered. The Security Group should feel free to declassify this if
they think it's not a security bug.

Gerv

Comment 1

[Gervase Markham [:gerv]]

Nul points pour moi.

Build ID: 2002100521.
OS: Linux, Red Hat 7.1.

Gerv

Comment 2

[Gervase Markham [:gerv]]

CCing some people from bug 172210, which may have caused this.

Gerv

Comment 3

[(not reading, please use [e-mail] instead)]

ducarroz, is this a dup of #172808?

Comment 4

[Jean-Francois Ducarroz]

Yes, this is a dup of 172808

*** This bug has been marked as a duplicate of 172808 ***

Comment 5

[Olga]

Verified dup