Apache - .pl CGI Scripts & IE File Save Dialog

[anandxk]

Posted on Perl forum with no luck. Hope someone can help:

'lo folks. This has probably been asked before but I haven't found a complete explanation yet.

Running:
Win2K Pro SP3
Apache 1.3.26
ActivePerl 5.6.1

IE shows a File Save dialog when the CGI script has:
Content-type: text/plain
and the extension is .pl.
eg.

http://localhost/cgi-bin/printenv.pl

The unusual part is that the following URL :

http://localhost/cgi-bin/printenv.pl/

does return the Environment Variables. Why does adding the / make a difference?

Thanks in advance.

 

[sleipnir214]

It's because IE pays more attention to file extensions than it does to content-type headers.

In the first URL, IE knows it's going to be receiving a file with a .pl extension. IE doesn't know what to do with a file of that extension, so it reverts to its default behavior for files it doesn't know how to handle -- saving the file.

In the case of the second URL, IE is fooled into thinking that printenv.pl is a directory name. Since it doesn't know what the extension of the file is, it actually pays attention to the content-type header, and correctly displays the file.

There are a number of security advisories about this problem with IE. Enter the search term '"Internet explorer" HTTP "content-disposition"' into Google to see more. ______________________________________________________________________
TANSTAAFL!

 

[anandxk]

Thanks! Found several relevant articles:

The Content-type Saga

http://ppewww.ph.gla.ac.uk/~flavell/www/content-type.html

Cross Site Scripting Info: Apache Specific

http://httpd.apache.org/info/css-security/apache_specific.html

Web Browsers Ignore Content-Type Headers Allowing Cross-site Scripting

http://www.securiteam.com/securitynews/5FP0F1P6AK.html