Skip to content

MMS: Chatty blindly trusts the MIME Type of the attachment from the MMS header

In: https://source.puri.sm/Librem5/chatty/-/blob/master/src/mm/chatty-mmsd.c#L1051

Chatty takes the mimetype directly from mmsd-tng, which is from the MMS.

The MIME type is just a header in the MMS, and there is no verification that the file attached is that MIME type in mmsd-tng or in chatty. As a safety/security precaution, should we just look up the MIME type ourselves and not trust what the MMS tells us it is?

Edited by Chris Talbot
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information