TCP/IP Tutorial and Technical Overview - IBM Redbooks

► Application
This type is intended for types that do not fit into other categories, and
particularly for data to be processed by an application program before being
presented to the user, such as spreadsheet data. It is also intended for
application programs that are intended to be processed as part of the mail
reading process (for example, see the PostScript type). This type of usage
poses serious security risks unless an implementation ensures that
executable mail messages are run in a safe or padded cell environment.
Two subtypes are defined initially:
– PostScript: Adobe Systems PostScript (Level 1 or Level 2)
PostScript security issues: Although PostScript is often thought of as a
format for printer data, it is a programming language and the use of a
PostScript interpreter to process application/PostScript types poses
serious security problems. Any mail reader that automatically interprets
PostScript programs is equivalent, in principle, to one that automatically
runs executable programs it receives. RFC 2046 outlines the issues
involved.
– octet-stream
This subtype indicates general binary data consisting of 8-bit bytes. It is
also the subtype that a mail reader assumes on encountering an unknown
type or subtype. Any parameters are permitted, and RFC mentions two: a
type= parameter to inform the recipient of the general type of the data,
and padding= to indicate a bit stream encoded in a byte stream. (The
padding value is the number of trailing zero bits added to pad the stream
to a byte boundary.)
Implementations are recommended to offer the user the option of using
the data as input to a user program or storing it in a file. An optional
Content-Disposition: field, described in RFC 2183, allows the
specification of the preferred name of such a file.
Security issues: The RFCs strongly recommend against an
implementation automatically executing an application/octet-stream part
or using it as input to a program specified in the mail header. To do so
exposes the receiving system to serious security risks and might impact
the integrity of any networks to which the system is connected.
Obviously, there are many types of data that do not fit into any of the previous
subtypes. Cooperating mail programs can, in keeping with the rules of RFC
2822, use types or subtypes beginning with X- as private values. No other values
are permitted unless they have first been registered with the Internet Assigned
Numbers Authority (IANA). See RFC 2048 for more details. The intention is that
few, if any, additional types will be needed, but that many subtypes will be added
to the set.
Chapter 15. Mail applications 581