Re: [secdir] review draft-ietf-httpbis-content-disp-06

Oh, all right, you can use numbers, too.  Slippery slope and all.

Hilarie

----- Original Message -----
From: "Stewart Bryant" <stbryant@cisco.com>
To: "Hilarie Orman" <ho@alum.mit.edu>
Cc: "julian reschke" <julian.reschke@greenbytes.de>, draft-ietf-httpbis-content-disp-06@tools.ietf.org, iesg@ietf.org, secdir@ietf.org
Sent: Monday, March 14, 2011 12:30:47 PM
Subject: Re: [secdir] review draft-ietf-httpbis-content-disp-06

> > From a security viewpoint, I think the protocol should restrict
> filenames to ascii alphabetic characters (no "." or "/"), and that if
> the filename does not conform, the receiver SHOULD reject the message
> and send an error code back to the sender.  The sender should not be
> allowed to specify a file extension.  The receiver SHOULD write the
> files into a quarantined disk area using a temporary filename, the
> file to be released to the recommended name pending manual review.
> But, that would break the world, as would so many security
> recommendations.
Surely you mean ascii alpha-numeric characters?

Text fixing this would also address the security component of my Discuss.

- Stewart
_______________________________________________
secdir mailing list
secdir@ietf.org
https://www.ietf.org/mailman/listinfo/secdir