lynx-dev Security Problem (was: J. Poon: Lynx problems)

[David Woolley]

> Lynx can't recognize it and try to view it on screen.  After I interrupted
> it in the middle, the screen goes crazy and keeps on sending keystrokes to
> Lynx in a cycle (which shouldn't as I hadn't pasted anything at that

If you are using a standard configuration, and have a display character
set which is not transparent, there is a case for a CERT advisory here.
If Lynx is not suppressing control characters in plain/text display mode,
it is vulnerable to a per-internet form of attack.  However, if you are
running it transparently, to support a Chinese display, you either need
to describe the display character set more accurately, or add code which
accurately filters the displayed characters.

Maybe the documentation for transparent display should include a disclaimer
that no responsibility is accepted for security compromises.

> 
> This bring to me one question.  Shouldn't Lynx at least ask the user first
> before handling an unidentified URL before assuming text/plain?  Or do I
> have to adjust .Mailcap and .mime.types and lynx.cfg before I can change
> Lynx's disastarous default behaviour, _especially on FTP access_? 
> 

As pointed out elsewhere, http URLs which show this behaviour are broken at
the server.  FTP links should have the binary ; modifier, if there is
any doubt, although, I had problems with proxies (squid I think did the
gatewaying) which didn't recognize this - I was trying to force text mode
on the IANA media-types file.

Unix servers generally have mechanisms for very tight control of media
types; the problems come from Microsoft's IIS, which requires executable
extensions if you want control at anything except the whole server level,
and ISP "free" pages, where the punters do not have access to the server
configuration, or don't know how.