Posted on December 23rd, 2008 in Security
Update: MS fixed this issue in the IE8 6/9/09 security update. Now IE8 behaves like Firefox (unclear on whether ‘X-Download-Options: noopen’ still exists at all). I have noticed a Cross-Site Scripting vulnerability in the way Internet Explorer handles the downloading and opening of HTML files when they are downloaded as an attachment, rather than opened [...]