mime page 2 - Dave's Blog

Search
My timeline on Mastodon

Web Security Research- Alex's Corner: HTTP Range & Request-Range Request Headers

2008 May 2, 1:55Avoid sniffing using the HTTP range header: "...if we have an application...which protects against FindMimeFromData XSS attacks by searching the first 256 bytes for certain strings, then we can simply place our strings after the first 256 bytes and get FlPermalinkCommentsvia:swannman http http-header range xss security

URI Fragment Info Roundup

2008 Apr 21, 11:53

['Neverending story' by Alexandre Duret-Lutz. A framed photo of books with the droste effect applied. Licensed under creative commons.]Information about URI Fragments, the portion of URIs that follow the '#' at the end and that are used to navigate within a document, is scattered throughout various documents which I usually have to hunt down. Instead I'll link to them all here.

Definitions. Fragments are defined in the URI RFC which states that they're used to identify a secondary resource that is related to the primary resource identified by the URI as a subset of the primary, a view of the primary, or some other resource described by the primary. The interpretation of a fragment is based on the mime type of the primary resource. Tim Berners-Lee notes that determining fragment meaning from mime type is a problem because a single URI may contain a single fragment, however over HTTP a single URI can result in the same logical resource represented in different mime types. So there's one fragment but multiple mime types and so multiple interpretations of the one fragment. The URI RFC says that if an author has a single resource available in multiple mime types then the author must ensure that the various representations of a single resource must all resolve fragments to the same logical secondary resource. Depending on which mime types you're dealing with this is either not easy or not possible.

HTTP. In HTTP when URIs are used, the fragment is not included. The General Syntax section of the HTTP standard says it uses the definitions of 'URI-reference' (which includes the fragment), 'absoluteURI', and 'relativeURI' (which don't include the fragment) from the URI RFC. However, the 'URI-reference' term doesn't actually appear in the BNF for the protocol. Accordingly the headers like 'Request-URI', 'Content-Location', 'Location', and 'Referer' which include URIs are defined with 'absoluteURI' or 'relativeURI' and don't include the fragment. This is in keeping with the original fragment definition which says that the fragment is used as a view of the original resource and consequently only needed for resolution on the client. Additionally, the URI RFC explicitly notes that not including the fragment is a privacy feature such that page authors won't be able to stop clients from viewing whatever fragments the client chooses. This seems like an odd claim given that if the author wanted to selectively restrict access to portions of documents there are other options for them like breaking out the parts of a single resource to which the author wishes to restrict access into separate resources.

HTML. In HTML, the HTML mime type RFC defines HTML's fragment use which consists of fragments referring to elements with a corresponding 'id' attribute or one of a particular set of elements with a corresponding 'name' attribute. The HTML spec discusses fragment use additionally noting that the names and ids must be unique in the document and that they must consist of only US-ASCII characters. The ID and NAME attributes are further restricted in section 6 to only consist of alphanumerics, the hyphen, period, colon, and underscore. This is a subset of the characters allowed in the URI fragment so no encoding is discussed since technically its not needed. However, practically speaking, browsers like FireFox and Internet Explorer allow for names and ids containing characters outside of the defined set including characters that must be percent-encoded to appear in a URI fragment. The interpretation of percent-encoded characters in fragments for HTML documents is not consistent across browsers (or in some cases within the same browser) especially for the percent-encoded percent.

Text. Text/plain recently got a fragment definition that allows fragments to refer to particular lines or characters within a text document. The scheme no longer includes regular expressions, which disappointed me at first, but in retrospect is probably good idea for increasing the adoption of this fragment scheme and for avoiding the potential for ubiquitous DoS via regex. One of the authors also notes this on his blog. I look forward to the day when this scheme is widely implemented.

XML. XML has the XPointer framework to define its fragment structure as noted by the XML mime type definition. XPointer consists of a general scheme that contains subschemes that identify a subset of an XML document. Its too bad such a thing wasn't adopted for URI fragments in general to solve the problem of a single resource with multiple mime type representations. I wrote more about XPointer when I worked on hacking XPointer into IE.

SVG and MPEG. Through the Media Fragments Working Group I found a couple more fragment scheme definitions. SVG's fragment scheme is defined in the SVG documentation and looks similar to XML's. MPEG has one defined but I could only find it as an ISO document "Text of ISO/IEC FCD 21000-17 MPEG-12 FID" and not as an RFC which is a little disturbing.

AJAX. AJAX websites have used fragments as an escape hatch for two issues that I've seen. The first is getting a unique URL for versions of a page that are produced on the client by script. The fragment may be changed by script without forcing the page to reload. This goes outside the rules of the standards by using HTML fragments in a fashion not called out by the HTML spec. but it does seem to be inline with the spirit of the fragment in that it is a subview of the original resource and interpretted client side. The other hack-ier use of the fragment in AJAX is for cross domain communication. The basic idea is that different frames or windows may not communicate in normal fashions if they have different domains but they can view each other's URLs and accordingly can change their own fragments in order to send a message out to those who know where to look. IMO this is not inline with the spirit of the fragment but is rather a cool hack.

PermalinkCommentsxml text ajax technical url boring uri fragment rfc

dretblog: Fragment Identifiers for Plain Text Documents

2008 Apr 16, 6:58Eric Wilde talks about his text plain fragment RFC becoming a standard.PermalinkCommentsblog mime uri fragment text erik-wilde

RFC 5147 - URI Fragment Identifiers for the text/plain Media Type

2008 Apr 16, 6:42The URI fragment for text/plain is finally a Proposed Standard!PermalinkCommentsuri fragment mime web rfc standards

Media Fragments Working Group

2008 Apr 16, 6:42A working group devoted to getting fragments to ID pieces of images or time positions or ranges in audio and video.PermalinkCommentsmime w3c standard uri fragment

RFC 2231 MIME Parameter Value and Encoded Word Extensions: Character Sets, Languages, and Continuations

2008 Mar 8, 11:44"This memo defines extensions to the RFC 2045 media type and RFC 2183 disposition parameter value mechanisms to provide ... a means to specify parameter values in character sets other than US-ASCII..."PermalinkCommentshttp http-header rfc standard reference ietf mime encoding charset language content-disposition

MSIE facilitates Cross Site Scripting [splitbrain.org]

2008 Mar 6, 2:22Using IE's mimetype sniffing for XSS attacks.PermalinkCommentsmime http sniffing sniff security browser ie ie7 pdf

URI Addressable Text Adventure Games

2008 Mar 2, 9:18

This post is about creating a server side z-code interpreter that represents game progress in the URI. Try it with the game Lost Pig.

I enjoy working on URIs and have the mug to prove it. Along those lines I've combined thoughts on URIs with interactive fiction. I have a limited amount of experience with Inform which generates Z-Code so I'll focus on pieces written in that. Of course we can already have URIs identifying the Z-Code files themselves, but I want URIs to identify my place in a piece of interactive fiction. The proper way to do this would be to give Z-Code its own mimetype and associate with that mimetype the format of a fragment that would contain the save state of user's interactive fiction session. A user would install a browser plugin that would generate URIs containing the appropriate fragment while you play the IF piece and be able to load URIs identifying Z-Code files and load the save state that appears in the fragment.

But all of that would be a lot of work, so I made a server side version that approximates this. On the Web Frotz Interpreter page, enter the URI of a Z-Code file to start a game. Enter your commands into the input text box at the bottom and you get a new URI after every command. For example, here's the beginning of Zork. I'm running a slightly modified version of the Unix version of Frotz. Baf's Guide to the IF Archive has lists of IF games to try out.

There are two issues with this thought, the first being the security issues with running arbitrary z-code and the second is the practical URI length limit of about 2K in IE. From the Z-Code standard and the Frotz source it looks like 'save' and 'restore' are the only commands that could do anything interesting outside of the Z-Code virtual machine. As for the length-limit on URIs I'm not sure that much can be done about that. I'm using a base64 encoded copy of the compressed input stream in the URI now. Switching to the actual save state might be smaller after enough user input.

PermalinkCommentszork frotz interactive-fiction zcode if technical uri fragment

Gmail S/MIME for Firefox

2007 Oct 15, 1:33Info on a plugin for FireFox that gives GMail S/MIME support. This is a similar idea to the last but these folks have executed the idea in a different fashion.PermalinkCommentsarticle browser blog cryptography crypto mail mime mozilla pgp privacy security extension firefox gmail google

Date Time Formats

2007 Sep 27, 2:17Starting on a new simple project I wanted to get the history of my Delicious links. Delicious has an export tool available via the settings section so I thought I'd try that. However, the links aren't exported in XML not even in XHTML but rather in HTML. Shocking. An example:
"Don't Tase Me, Bro!" (UF Student Tasered Remix)
Remix of the 'Don't tase me, bro!' guy getting tasered.At this point I'm already not going to use this file because its in HTML but I'm even more disgusted by those date time values. Raymond Chen of the Old New Thing posted about recognizing timestamps and timestamp sentinel values. From the first blog post and with the use of a calculator for base conversion one can tell that those are UNIX style timestamps counting the number of seconds since 1970.

It reminds me of my hatred for the MIME date time format I developed working on my webpage's server side parsing of atom and RSS. Atom is of course my favorite as Atom uses the Internet date time format described in the following documents. Here's an example of one 2007-09-27T020:50:00.000-08:00 On the other hand the evil and villainous RSS uses the MIME date time format now described in the more recent IETF MIME standard. Here's an example Thu, 27 Sep 2007 20:50:00 -0800
The Internet date time format has the advantage of being so easy to sort. An alphabetic sort with normal C-style collation rules of strings containing Internet date times will also sort them chronologically. This is not the case for the MIME date time due to the preceding day of the week and the spelled out month name. This also means that when producing these you have to figure out the day of the week and when parsing them you have to match month names rather than just parsing out numbers. Anyway now days if I see mention of a date time in a new proposed standard or spec I be sure to point out the numerous advantages of the Internet date time format.
PermalinkCommentsdate xml html feed time technical date-time code atom rss

RFC 4288 Media Type Specifications and Registration Procedures

2007 Sep 10, 5:08Syntax of mime-type names.PermalinkCommentsmime reference standard ietf internet mimetype contenttype rfc

RFC 2388 Returning Values from Forms: multipart/form-data

2007 Jun 15, 3:44Info on the format of the MIME type that contains data from an HTML form submission of enctype multipart/form-data.PermalinkCommentsform html mime multipart encoding rfc reference internet ietf

New XSLT - IE7 XML Source View Upgrade Part 2

2007 May 11, 8:55Last time, I had written some resource tools to allow me to view and modify Windows module resources in my ultimate and noble quest to implement the XML content-type fragment in IE7. Using the resource tools I found that MSXML3.DLL isn't signed and that I can replace the XSLT embedded resource with my own, which is great news and means I could continue in my endevour. In the following I discuss how I came up with this replacement for IE7's XML source view.

At first I thought I could just modify the existing XSLT but it turns out that it isn't exactly an XSLT, rather its an IE5 XSL. I tried using the XSL to XSLT converter linked to on MSDN, however the resulting document still requires manual modification. But I didn't want to muck about in their weird language and I figured I could write my own XSLT faster than I could figure out how theirs worked.

I began work on the new XSLT and found it relatively easy to produce. First I got indenting working with all the XML nodes represented appropriately and different CSS classes attached to them to make it easy to do syntax highlighting. Next I added in some javascript to allow for closing and opening of elements. At this point my XSLT had the same features as the original XSL.

Next was the XML mimetype fragment which uses XPointer, a framework around various different schemes for naming parts of an XML document. I focused on the XPointer scheme which is an extended version of XPath. So I named my first task as getting XPaths working. Thankfully javascript running in the HTML document produced by running my XSLT on an XML document has access to the original XML document object via the document.XMLDocument property. From this this I can execute XPaths, however there's no builtin way to map from the XML nodes selected by the XPath to the HTML elements that I produced to represent them. So I created a recursive javascript function and XSLT named-template that both produce the same unique strings based on an XML node's position in the document. For instance 'a3-e2-e' is the name produced for the 3rd attribute of the second element of the root element of the XML document. When producing the HTML for an XML node, I add an 'id' attribute to the HTML with the unique string of the XML node. Then in javascript when I execute an XPath I can discover the unique string of each node in the selected set and map each of them to their corresponding positions in the HTML.

With the hard part out of the way I changed the onload to get the fragment of the URI of the current document, interpret it as an XPath and highlight and navigate to the selected nodes. I also added an interactive floating bar from which you can enter your own XPaths and do the same. On a related note, I found that when accessing XML files via the file URI scheme the fragment is stripped off and not available to the javascript.

The next steps are of course to actually implement XPointer framework parsing as well as the limited number of schemes that the XPointer framework specifies.PermalinkCommentsxml xpointer msxml res xpath xslt resource ie7 technical browser ie xsl

RFC 822 Standard for ARPA Internet Text Messages

2007 Apr 12, 12:40Early standard for date time formats for MIME messages.PermalinkCommentsstandard date time format internet mime rfc reference

RFC 2045 Multipurpose Internet Mail Extensions (MIME) Part One: Format of Internet Message Bodies

2007 Mar 8, 1:01Definition of Quoted-Printable an encoding used in MIME.PermalinkCommentsmime encoding quoted-printable ietf rfc reference standard

The 'text/html' Media Type (RFC 2854)

2007 Feb 27, 12:35The media type defintion for HTML. Includes defintion of its fragment.PermalinkCommentsuri html fragment rfc ietf reference standard mime

URI Fragment Identifiers for the text/plain Media Type (draft-wilde-text-fragment-06)

2007 Feb 22, 10:15Draft document that would update text/plain to allow for fragments identifying portions of the document.PermalinkCommentsmime uri fragment text-plain rfc ietf reference standard

RFC 4180 - Common Format and MIME Type for Comma-Separated Values (CSV) Files

2007 Jan 30, 2:41I was unaware of it but there's a standard for CSV files and it defines how to encode quotes, commas, and newlines inside of records.PermalinkCommentscsv specification rfc standards ietf mime comma-separated-value excel encoding

RFC 1847 - Security Multiparts for MIME: Multipart/Signed and Multipart/Encrypted

2006 Dec 27, 9:42This document defines a framework within which security services may be applied to MIME body parts.PermalinkCommentsrfc mime internet reference privacy encryption security encoding authentication read

RFC 3156 - MIME Security with OpenPGP

2006 Dec 27, 9:37This document describes how the OpenPGP Message Format can be used to provide privacy and authentication using the MIME security content types described in RFC 1847.PermalinkCommentsrfc pgp openpgp mime internet reference privacy encryption security encoding authentication read
Older EntriesNewer Entries Creative Commons License Some rights reserved.