Menu

#46 E-Mail client can be tricked into submitting too much data

open
nobody
5
2004-05-25
2004-05-25
No

If the email clietn is replying to a message with lots of
htmlentities-style characters (greater-than and less-than signs,
especially), it can be tricked into sending more than 64K of data to
appslink.net/file/open. There's already something that restricts
that, but the excessive quoting sneaks past it. Obviously, it should
count the size of the data _after_ escaping it.

Discussion


Log in to post a comment.