256569 - Semicolon in attachment name causes rightside to be hidden

Status: RESOLVED DUPLICATE of bug 243504

(MailNews Core :: Attachments, defect)

Description

[hansen]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.2) Gecko/20040820 Firefox/0.9.1+
Build Identifier: Thunderbird version 0.7+ (20040820)

make a file called "shown;hidden.doc", then attachment pane will only show it as
"shown"

i would mark this as critical, if i could successfully make a file execute as
another extension - example "document.doc;virus.exe"

Reproducible: Always
Steps to Reproduce:

Comment 1

[Jo Hermans]

> i would mark this as critical, if i could successfully make a file execute as
> another extension - example "document.doc;virus.exe"

Actually, Mozilla sends a mail that only contains "document.doc", so the problem
might be in the file-selector code. When a mail is received with
"document.doc;virus.exe", you'll get an option to save a file with that name,
senmicolon included.

I was pretty sure that this was field before, but I can't find it back.

Comment 2

[hansen]

did a search on "semicolon" witch didn't return anything, so i filed this

but you're right - doesn't send anything, that could be a security issue

Comment 3

[OstGote!]

I guess it is related to Bug 239192 and all the blocked bugs. The filename will
be truncated. Same thing for Seamonkey MailNews. I guess it is so because the
parser interprets the filenames as URIs and strips off # and ;.

Comment 4

[Jo Hermans]

*** This bug has been marked as a duplicate of 243504 ***