Re: comments on draft-abarth-mime-sniff-03

[Adam Barth <[e-mail]>]

On Sat, Jan 23, 2010 at 3:25 AM, Adam Barth <[e-mail]> wrote:
> On Fri, Jan 22, 2010 at 5:34 PM, Larry Masinter <[e-mail]> wrote:
>> I suggest including this example in the security considerations section
>> of the document.
>
> Will do.

Actually, I've just included the example inline in the text because
the document doesn't have a separate security considerations section.
In some sense, the entire document is one giant security
considerations section.

>>>> What is the security threat?
>>
>>> The security threat is that if you treat an HTML file extension as
>>> evidence the server wants the response to be treated as text/html you
>>> will introduce XSS vulnerabilities into some large number of sites
>>> running PHP (among others).
>>
>> Yes, I think this belongs in the "security considerations" section
>> of the document.
>
> Will do.

This is explained in the introduction.

Adam