view release on metacpan or  search on metacpan

doc/faq/security.html  view on Meta::CPAN

<li><p>Generally, web servers provide the ability deny access
to files.  Refer to your web server's documentation for the specifies.
If you are using the <a href="http://httpd.apache.org/">Apache HTTP server</a>,
the following configuration directive can be used:
</p>
<pre class="code">
&lt;Files .mhonarc.db&gt;
    Order allow,deny
    Deny from all
&lt;/Files&gt;
</pre>
<p>If you have <tt>mod_rewrite</tt> enabled, you could use the following
instead:
</p>
<pre class="code">
RewriteRule ^(.*)/.mhonarc.db $1 [R=permanent]
</pre>
<p>This will redirect browsers to the parent directory, which is
the actual archive associated with database file.
</p>
</li>

<li><p>The <a href="../resources/dbfile.html">DBFILE</a> resource can
be used to rename the database file to some arbitrary, not easily
guessed, name of your choosing.  However, this does not prevent brute
force attempts to access the file.
</p>
</li>

<li><p><a href="../resources/dbfile.html">DBFILE</a> resource can
be set to a full pathname that is in a non-web server
accessible location.
</p>
<table class="note" width="100%">
<tr valign="baseline">
<td><strong>NOTE:</strong></td>
<td width="100%"><p>
Using a full pathname for <a href="../resources/dbfile.html">DBFILE</a> is
supported only in v2.5.13, or later.
</p>
</td>
</tr>
</table>
</li>

</ul>

<!-- ??????????????????????????????????????????????????????????????? -->
<hr noshade size=1>
<table border=0>
<tr valign=baseline><td><img src="monicon.png" align="bottom" alt=""></td><td>
<h3><b><a name="htmldata">Why are HTML messages a security risk?</a></b></h3>
</td></tr></table>

<p>HTML can contain dynamic content, like JavaScript.  If an
HTML message is blindly archived, you are introducing foreign dynamic
content to your web site that you have no control over.  The best
example of this danger is the problem web-based email sites (e.g.
Hotmail) encountered when malicious people were sending HTML messages
to web-based email users and the messages contained dynamic content
that would popup windows (which had a similiar style of the web-based
email hosting provider) requesting sensitive information from
users (like passwords).
</p>

<p>These types of attacks are classified as <em>Cross-Site
Scripting</em> (XSS) attacks by the security community.  The common
goal for XSS attacks is to obtain private information of a user,
like browser cookies used for site authentication.  </p>

<p>The following is a brief list of some of the security issues
related to HTML messages:
</p>
<ul>
<li>Can contain foreign dynamic content.
    </li>
<li>Can autoload URLs (via IMG, and similiar, elements) which
    can be used to collect statistics on unsuspected readers.
    </li>
<li>Contain hidden contents (like server-side include comments)
    which may be processed by web servers to execute arbitrary
    programs or extract arbitrary system files.
    </li>
</ul>

<p>MHonArc's HTML filter (documented under the <a href="../resources/mimefilters.html">MIMEFILTERS</a>)
resource provides functionality of stripping out HTML data to
minimize security exploits.  Check the document for full details.
The general recommendation for the security conscience is to exclude
any HTML message data (see <a href="#htmlexchow">next question</a>).

<!-- ??????????????????????????????????????????????????????????????? -->
<hr noshade size=1>
<table border=0>
<tr valign=baseline><td><img src="monicon.png" align="bottom" alt=""></td><td>
<h3><b><a name="htmlexchow">So how can I exclude HTML mail?</a></b></h3>
</td></tr></table>

<p>The quickest method is
via the <a href="../resources/mimeexcs.html">MIMEEXCS</a> resource:
<p>
<pre class="code">
<b>&lt;MIMEExcs&gt;</b>
text/html
text/x-html
<b>&lt;/MIMEExcs&gt;</b>
</pre>

<p>Unfortunately, for messages that contain only HTML data, the
entire message body will be excluded.  Therefore, you may still
want to show the data, but have it so the HTML markup is completely
neutralized.  The following resource settings will neutralize the
dangers of HTML messages without excluding message data:
</p>

<pre class="code">
&lt;!-- It is common for popular MUA's to provide a text/plain version
     of the text/html version of a message body.  Therefore, we
     use MIMEALTPREFS to choose the text/plain version if available.
  --&gt;
<b><a href="../resources/mimealtprefs.html">&lt;MimeAltPrefs&gt;</a></b>