bugtraq - RE: blocking gzip encoded files

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Tue, 24 Feb 2004 16:49:01 +0000
From: Gervase Markham <gerv@...illa.org>
To: bugtraq@...urityfocus.com
Subject: RE: blocking gzip encoded files

Darwin Mecham wrote:
 > It has recently come to my attention that most browsers happily
 > do Accept-encoding: gzip and streaming decompression of
 > HTML data received with Content-encoding: gzip
 > without asking.
 > ...
 >
 > Is there a way to configure the run-of-the-mill browser to
 > block these at the host level ?

You can turn this off in Mozilla by changing the pref 
"network.http.accept-encoding", whose default value is "gzip,deflate".

You can set this in "about:config" in recent Mozilla builds, or by 
editing prefs.js or user.js in your profile using instructions available 
on the web.

This has been in Mozilla since May 2001, and should therefore be 
available in Netscape 7.x, Camino, Firefox et al. also.
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/netwerk/protocol/http/src/nsHttpHandler.cpp#927

Gerv