• Summary Technical Background:

  Netscape has implemented fixes to the portions of our software containing these problems and reviewed them with outside experts. By adding more explicit checks to the Java Applet Security Manager, applets in Netscape Navigator 2.01 will be correctly restricted from making any network connections to hosts other than the Java host. Similarly, JavaScript will now be correctly limited from listing the files of a directory and limited from automatically posting mail and news form elements. Netscape has also improved the safety of URL parsing by disallowing gopher connections to non-standard ports and by searching for new line characters in gopher URL strings and stopping URLs containing such characters from being executed.

• Relating to Java:

  A potential vulnerability existed in Netscape Navigator 2.0 that could allow a Java applet to take advantage of weaknesses in the Domain Name Service (DNS) and connect over the network to an arbitrary computer. When a Java applet is downloaded over the network, the Java Applet Security Manager will only allow an applet to set up the network connection to an IP address matching the address of the Java host. By using the DNS server to advertise multiple IP addresses for the Java host, where one of the addresses really belongs to a different computer, the Java Applet Security Manager could be tricked into connecting to a computer other than the Java host. Netscape Navigator 2.01 improves the checking of computer names and IP addresses so that it will only allow an applet to make a network connection to the Java Host.

  A flaw in the implementation of the Java applet class loader could have allowed an applet to bypass certain security checks in limited circumstances where file uploads were possible. Netscape Navigator 2.01 solves this problem by making sure any files accessed by the class loader are subject to the complete suite of security checks.

• Relating to JavaScript:

  A user's email address is currently made available to JavaScript. Because of the automation of certain JavaScript functions, a user's email addresses could have been inadvertently exposed to individuals without the user knowing it, compromising the user's privacy. Netscape Navigator 2.01 solves this privacy problem by limiting JavaScript's ability to automatically post mail or news from form elements. This ensures that user interaction is required to send mail or post news messages.

  Another feature of JavaScript is the ability for a server script to list files and directories. Due to an implementation problem in Netscape Navigator 2.0, a privacy concern existed because it was possible for a server script to access the listing of local file names and directories on the user's machine. This problem did not allow the server to see the contents of any local files or modify local files in any way. Navigator 2.01 fixes this problem by refusing to allow a script from a server to view file names and directory listings from the local user's machine.

• Relating to Ports:

  2.01 fixes a problem where it was possible for a Gopher URL to be used to send commands to ports other than those that were reasonable for the Gopher service. It was possible that this feature could be used to exploit other security vulnerabilities behind firewalls. Navigator 2.01 fixes this problem by limiting the ports that a Gopher URL can access and by disallowing certain control characters in a valid Gopher URL.

Java Applets

JavaScript

Read Mail with Netscape Navigator

• Reading your email: A new Mail Window allows you to read your email, sort the messages, file them in folders, and mail replies.

• New Mail Reading Window: The Mail Window has 3 panes: a mail folder pane, a message list pane, and a message text pane. You can adjust the relative sizes of the panes by dragging the pane dividers. You may want to start by making the mail folder pane a little wider so that you can see the names of the mail folders. The individual columns in each pane can be adjusted. Hold the mouse over the column titles. A corner will activate when you're at the end of a column title. You can drag and drop the corner to resize the columns.

  Netscape comes with a sample mail message. Click on the "inbox" folder to see the message. You can use the toolbar button or menu to Get New Mail. You can navigate through your mail messages by clicking on the "Date", "Sender", or "Subject" fields of the message list pane. The buttons and Go Menu also help you navigate.

  A bold message in the message list signifies that you have not read this message yet. Once you read it, it becomes normal (i.e. unbold).

• Send Now or Send Later - Deferred Mail: Netscape allows you to compose all your email off-line and then send them all at once. When you're in the Message Composition Window, select Deferred Delivery from the Options menu. Deferred mail is stored in the OUTBOX folder. When you exit the Mail Window, you will be asked if you want the messages to be sent. You can also choose "File" | "Send Mail in Outbox" (from the Netscape Mail Window), to send all your deferred Mail.

• Organizing your Mail: The Sort Menu allows you to view your list of messages in various ways. You can even thread the messages by subject. The Edit Menu lets you select and delete messages. Deleted messages are put in a mail folder called "trash". You can create other mail folders with the File Menu.

• Mail Password: Netscape Mail remembers your mail password. To enable this feature, check the "Remember Mail Password" on the Organization panel of the Mail and News preferences.

• New Mail Indicator: There is a mail preference "Check for mail every n minutes" on the Servers panel of the Mail and News preferences. As long as the Navigator is running and the Mail password has been entered or saved, Netscape will check for new mail at the specified frequency. If there is new mail, the mail will not be automatically downloaded; the mail indicator in the lower right corner of the Browser, Mail, and News windows will change appearance. Click the mail indicator to open the Mail window and retrieve new mail.

• Find: You can search for text in the headers of mail and news messages using the Find command located on the Edit menu. Find searches the displayed headers of the messages in the current folder, starting with the current message. Use Find Again to continue with the next message.

Brand new News Interface

• New News Reading Window: The News Reader was rewritten to provide a more concise view of the news hosts, newsgroups, and articles. It uses the same type of 3-paned window that the Mail reader uses. Your existing newsrc file is compatible with the new news interface.

• Reading News Articles: Reading news is very much like reading mail messages. Instead of Getting New Mail, you can click on the newsgroup to bring up the list of articles and see the new ones that have arrived.

Message Composition Window

• Updated Mail and News Composition: A new Mail and News composition window lets you send new messages, and reply to or forward existing messages. Use the Options Menu | Show All Headers command to find fields for carbon copy, blind carbon copy (Bcc:), and file carbon copy (Fcc:) where you can save a copy for yourself.

• Link to the Address Book: You can type the names of users or mailing lists into the To:, CC:, and BCC: fields. When you click on a new field with the mouse, or hit tab, the email addresses will be expanded. Double-clicking on an entry in the address book will bring up a new Composition window, addressed to that address.

• Multiple Attachments: The Attach button lets you add and delete multiple attachments to your email message, including both local files and URLs.

• AppleDouble Attachments: Files sent as attachments from the Macintosh version of the Navigator are sent using AppleDouble encoding, which allows for the preservation of Macintosh file forks. On Windows and Unix versions of Navigator, you have the option of receiving these attachments as either a Macintosh file, which can be saved and transferred for use on a Macintosh, or as a data file which can be used on the receiving platform.

• More Options: Look at the Options Menu | Mail and News... | Compose pane for more mail composition options.

Address Book for Email Addresses

• Address Book Window: The address book looks and works very much like the bookmarks. You can view the whole address book by going to the Window Menu and choosing Address Book.

  Add Users from the Address Book Window's Item Menu, or automatically create an entry from the Message Menu in the Mail or News window.

  Do you have lists of people to send mail to? In the Address Book window, mailing lists are represented by the folder icon. Add list entries from the Address Book Window's Item menu, then drag and drop individual users into the list/folders.

  You can use these List and User entries in three ways. You can type the nicknames into the mail composition window in the To:, CC:, and BCC: fields. You can also double-click on an icon in the Address Book window to bring up a pre-addressed composition window.

New Bookmarks Feature

• Checks for changed Bookmarks: In Bookmark window, There is a What's New? menu item in the File menu that brings up a window that you can use to identify bookmarks that have changed since you last visited them. You can choose to check all bookmarks in the bookmark list, or just the selected bookmarks and bookmarks inside selected folders.

Better Images and Document Presentation

User Interface Changes

• Rearranged Menu Bar: A new Windows Menu has been added to the main menu bar, allowing you to easily switch between the Mail, News, History, Address book and Bookmarks windows. To open a New Web Browser window, use the File Menu.

• Rearranged Preferences: Under the Options Menu, the Preferences panel is divided into four separate panes: General..., Mail and News..., Network..., and Security. These changes were made to accommodate the new features in 2.01.

• View Menu | Document Source: Document Source (previously View Source) now gives you a multi-colored display of the HTML source of a document. It is displayed in a separate window that does not have menus or buttons.

• View Menu | Document Information in an HTML page: Document Information gives you detailed information about all of the images and frame documents in a Netscape window. (This information is displayed in a separate window.) You can click on the links in the top half of that window to change the detailed information in the bottom half of the window. It's also a good demonstration of frames.

Access Improvements

International Support

• Previous releases support browsing Western European languages and Japanese. Navigator 2.01 adds support for Central European (latin2) languages, Korean, Simplified Chinese and Traditional Chinese.

• MIME charsets supported include:
  "us-ascii", "iso-8859-1", "x-mac-roman", "iso-8859-2", "x-mac-ce"
  "iso-2022-jp","x-sjis", "x-euc-jp",
  "euc-kr", "iso-2022-kr",
  "gb2312", "gb_2312-80"
  "x-euc-tw", "x-cns11643-1", "x-cns11643-2", "big5"

• The support of languages requires the appropriate system font is installed on your system.

• For Japanese, Korean, Simplified Chinese and Traditional Chinese, the system must also provide support for 2-byte codes and input methods. For Windows, you will need Japanese Windows, Korean Windows or Chinese Windows.

• Options | General Preferences | Language "Accept Language" enables the user to select a prioritized list of language/region codes that reflect what language a user wishes to display a document in, if that document is available in different language translations. The "accept language" information is contained in the HTTP Header's HTTP_ACCEPT_LANGUAGE. A server that provides different language versions of the same content could thus accommodate a user's preferred language.

• Options | Document Encoding selection can be changed when viewing Mail and News in addition to the Web Browser window. The selected encoding will be applied to enable viewing of documents of different encodings (e.g. Japanese) provided the user's system supports fonts for that locale.

META Tag Extension for MIME Charset Info

• The IETF draft on Internationalization of the Hypertext Markup Language proposes an extension to the HTML META tag to allow MIME charset information to be contained in the HTML document:

  <META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=ISO-2022-JP">

• This support is in Navigator 2.01 and the MIME charset values supported includes all the charsets mentioned above in the section on "Additional Languages and MIME Charsets" Supported.

Document Encoding User Interface

• Document Encoding Defaults are now easier to change. Previous releases provided a preference panel to globally set the default character encoding of incoming documents.

• Navigator 2.01 makes the default selection more accessible by moving it to the "Options | Document Encoding->" menu item.

• Document encoding defaults are no longer global, so that a user may have multiple browser windows open in different default encodings (e.g., Japanese in one and French in another).

• Users who want to regularly view documents in encodings other than Latin1 should use the Options | Document Encoding menu item to choose the encoding, then select Options | Save Options to make it the default setting. For example, Japanese users will want to select Japanese (Auto-detect) from the Document Encoding list, then choose Save Options.

• User Defined encoding is available for encodings that we have not yet added support.

Automatic Proxy Configuration