Re: [media-types] I-D Action: draft-ietf-mediaman-suffixes-00.txt

[Harald Alvestrand <[e-mail]>]

Are there security concerns here?

It's long been a favorite game of virii and trojans to lie about what 
the inner type contains, and then try to leverage the fact that the 
inner type may dispatch on something different in order to induce 
unexpected processing.

For example, having a gzipped file "image/svg+xml+gzip", knowing that 
the XML parser will dispatch based on the XML declaration not the MIME 
type and instead putting a text/html file with embedded Javascript in there.

Or using the gzip "extract by name" facility and packing "virus.exe" 
inside "image/svg+xml+gzip", knowing that the next level of unpacking 
will dispatch on filename suffix?

These concerns exist (of course) with single-level suffix concatenation 
too, but multiple suffixes multiply the paths that can be taken.

I see that RFC 6838 section 4.6 does not note the particular danger of 
suffixed types; it may be a Good Thing to include a security section in 
this document that mentions the issue.

        Harald