[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

Re: [tor-bugs] #9901 [TorBrowserButton]: DoS of TBB 2.4/3.0 when no Content-Type header and more than 512 bytes of content are sent

#9901: DoS of TBB 2.4/3.0 when no Content-Type header and more than 512 bytes of
content are sent
----------------------------------+----------------------------------
     Reporter:  sqrt2             |      Owner:  mikeperry
         Type:  defect            |     Status:  new
     Priority:  normal            |  Milestone:
    Component:  TorBrowserButton  |    Version:
   Resolution:                    |   Keywords:  tbb dos content-type
Actual Points:                    |  Parent ID:
       Points:                    |
----------------------------------+----------------------------------
Changes (by cypherpunks):

 * status:  needs_review => new


Comment:

 [http://www.w3.org/Protocols/rfc2616/rfc2616-sec7.html#sec7.2.1 RFC 2616]:
 > Any HTTP/1.1 message containing an entity-body SHOULD include a Content-
 Type header field defining the media type of that body. If and only if the
 media type is not given by a Content-Type field, the recipient MAY attempt
 to guess the media type via inspection of its content and/or the name
 extension(s) of the URI used to identify the resource. If the media type
 remains unknown, the recipient SHOULD treat it as type "application/octet-
 stream".

 Returning string prevents inspecting of content. And returning
 "text/plain" violates specification.
 Doubly wrong way to fix bug.

 Only choice: Spam or DoS.

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/9901#comment:9>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs