[tor-bugs] #9901 [TorBrowserButton]: DoS of TBB 2.4/3.0 when no Content-Type header and more than 512 bytes of content are sent

[Tor Bug Tracker & Wiki]

#9901: DoS of TBB 2.4/3.0 when no Content-Type header and more than 512 bytes of
content are sent
----------------------------------+---------------------------
     Reporter:  sqrt2             |      Owner:  mikeperry
         Type:  defect            |     Status:  reopened
     Priority:  normal            |  Milestone:
    Component:  TorBrowserButton  |    Version:
   Resolution:                    |   Keywords:  tbb-usability
Actual Points:                    |  Parent ID:
       Points:                    |
----------------------------------+---------------------------

Comment (by gk):

 Replying to [comment:76 gk]:
 > Replying to [comment:74 mikeperry]:
 > > I can also try to bring this to Mozilla's attention to see if they are
 willing to write a proper fix themselves, since this silent app launching
 behavior is a longstanding issue in their own confirmation dialog system.
 >
 > Might at least be interesting to know what they think about it. I was
 always under the impression that this "feature" was on purpose to save
 some time: "The user clicks on the resource, hence she wants to have it
 (be it opened somewhere else or saving it), thus lets already download it
 in the background before the final decision is made".

 I forgot to add "and handle it if there is a (default) handler available".

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/9901#comment:77>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online