Thursday, December 13, 2012

Client-side heuristics for Safe PDF File

Some Guesses:

Wrong Content Type sending text\html instead of application\pdf
Encrypted Java Script

I'd imagine that the redirects are at least part of the cause, as those aren't directly related to a user gesture. Clicking directly through to the download is "safer" in this context than clicking on something, and being redirected through a variety of trackers and dispatchers, as the user can't be expected to follow along.
The heuristic also takes into account whether you've been to a particular URL or domain before; that could also have an impact on certain files showing up as "safe" and others not.
Related Chrome Files:
http://code.google.com/searchframe#OAMlx_jo-ck/src/chrome/browser/download/download_util.cc
http://code.google.com/searchframe#OAMlx_jo-ck/src/chrome/browser/download/chrome_download_manager_delegate.cc&exact_package=chromium&q=ChromeDownloadManagerDelegate::IsDangerousFile.



No comments: