Changeset 1202 for draft-ietf-httpbis-content-disp/latest/draft-ietf-httpbis-content-disp.html

Timestamp:

Mar 17, 2011, 9:34:09 AM (9 years ago)

Author:

julian.reschke@…

Message:

Strengthen file extension handling requirement

File:

• draft-ietf-httpbis-content-disp/latest/draft-ietf-httpbis-content-disp.html (modified) (2 diffs)

draft-ietf-httpbis-content-disp/latest/draft-ietf-httpbis-content-disp.html

@@ -643 +643 @@
          <li>
             <p>Many platforms do not use Internet Media Types (<a href="#RFC2046" id="rfc.xref.RFC2046.1"><cite title="Multipurpose Internet Mail Extensions (MIME) Part Two: Media Types">[RFC2046]</cite></a>) to hold type information in the file system, but rely on filename extensions instead. Trusting the server-provided file
-               extension could introduce a privilege escalation when the saved file is later opened (consider ".exe"). Thus, recipients <em class="bcp14">SHOULD</em> ensure that a file extension is used that is safe, optimally matching the media type of the received payload.
+               extension could introduce a privilege escalation when the saved file is later opened (consider ".exe"). Thus, recipients which
+               make use of file extensions to determine the media type <em class="bcp14">MUST</em> ensure that a file extension is used that is safe, optimally matching the media type of the received payload.
             </p>
          </li>
@@ -1041 +1042 @@
       </p>
       <h2 id="rfc.section.E.13"><a href="#rfc.section.E.13">E.13</a>&nbsp;<a id="changes.since.08" href="#changes.since.08">Since draft-ietf-httpbis-content-disp-08</a></h2>
-      <p id="rfc.section.E.13.p.1">Update: Internet Explorer 9 is released. Various editorial improvements. Add US-ASCII reference.</p>
+      <p id="rfc.section.E.13.p.1">Update: Internet Explorer 9 is released. Various editorial improvements. Add US-ASCII reference. Strengthen file extension
+         handling requirement to MUST for those recipients that actually use file extensions to map media types.
+      </p>
       <h1 id="rfc.index"><a href="#rfc.index">Index</a></h1>
       <p class="noprint"><a href="#rfc.index.C">C</a> <a href="#rfc.index.H">H</a> <a href="#rfc.index.I">I</a> <a href="#rfc.index.R">R</a> <a href="#rfc.index.U">U</a>