Re: [secdir] review draft-ietf-httpbis-content-disp-06

[Alexey Melnikov <[e-mail]>]

Hi Hilarie/Stewart,
A couple of quick comments:

Stewart Bryant wrote:

>> > From a security viewpoint, I think the protocol should restrict
>> filenames to ascii alphabetic characters
>
I don't think this is realistic. Filenames should be allowed to be in 
non-ASCII, as pure ASCII is not sufficient for naming files in many 
languages.

>> (no "." or "/"), and that if
>> the filename does not conform, the receiver SHOULD reject the message
>> and send an error code back to the sender.
>
This value is coming in a HTTP response from a server, so the client 
can't do that.

>> The sender should not be
>> allowed to specify a file extension.  The receiver SHOULD write the
>> files into a quarantined disk area using a temporary filename, the
>> file to be released to the recommended name pending manual review.
>> But, that would break the world, as would so many security
>> recommendations.
>
> Surely you mean ascii alpha-numeric characters?
>
> Text fixing this would also address the security component of my Discuss.