As far as I can see the uploaded HTMLs are just downloaded as normal files (e.g. archives or PDFs), so it’s up to the user and the browser settings (open automatically after download, …) whether to open them. But this topic mentions something about XSS… [image] Security checks on uploads Support If I can upload an HTML page I can do what’s called a Cross Site Scripting (XSS) attack, as some browsers will render gifs as HTML. Neal Poole from Facebook wrote about a Wordpress vuln like this back in 2011 The HTML file could have javascript in it, which I could use to do bad things. Again, I’m not a security researcher (though that’s what our community is made up of), so I can’t speak at length about XSS or test this thoroughly. I’m just wondering if you guys do anything to check headers o… As I understand there is no way to interact with the Discourse page from the downloaded file? So the worst it can do is show some kind of phishing content.

Could you please elaborate why? :thinking:

For exactly the same reason you wouldn’t want phishing links appearing on a community? Discourse isn’t a DMS or file storage, why would you use it just to facilitate the download of HTML files, surely code is better housed somewhere like GitHub?

Sometimes it’s more convenient to just upload HTML showing some simple issue, etc., and if it’s just one file then putting it into a ZIP archive only creates unnecessary difficulties. The forum is mainly for developers, so it should be safe to assume that they know what they are doing when opening the downloaded file and will recognize phishing attempts, will not enter any passwords there, quickly report it, etc. So the only concern is whether it is possible to exploit any vulnerabilities, XSS, etc. when uploading HTML files (comparing to ZIP archives with HTML files).

[image] Alex_P: Sometimes it’s more convenient to just upload HTML showing some simple issue, etc., and if it’s just one file then putting it into a ZIP archive only creates unnecessary difficulties. [image] Alex_P: The forum is mainly for developers, so it should be safe to assume that they know what they are doing when opening the downloaded file and will recognize phishing attempts, will not enter any passwords there, quickly report it, etc. As a personal preference, I prefer not to have to download any files at all. I’d rather just see the code in the post. So, my question is… is there any reason the HTML is not added directly in the posts as a code block? Introduction People have been catching fish for food since before recorded history… Equipment The first thing you’ll need is a fishing rod or pole that you find comfortable and is strong enough for the kind of fish you’re expecting to land… ... That way it’ll be visible right away, won’t require any files to be downloaded and won’t take up much space in the post - since we force scrollbars on code blocks beyond a certain height. Plus, there’s 0 security risks involved since it won’t be parsed at all. I can expand on this if this solution works for you.

[image] Johani: is there any reason the HTML is not added directly in the posts as a code block? Yeah, I agree that usually it’s better to do it this way, but sometimes people still prefer to attach files, e.g. when it is too big, or when they want to show some kind of visual issue (easier than copy-pasting to a new file, etc.).

Is it safe to allow HTML uploads?

Product Support

codinghorror (Jeff Atwood) December 21, 2019, 10:55pm 2

It’s not a good idea in my opinion.

Topic		Replies	Views
Is it safe to allow HTML uploads? (2023) Product Support	0	430	November 15, 2023
Security checks on uploads Product Support	35	8016	December 2, 2018
File Extensions: Concern with allowing PDF and word? Product Support	2	712	May 8, 2020
Explicitly disallowed file types? Product Support	1	1071	January 12, 2014
Markdown rendering issue with image surrounded with HTML Bug	23	4909	March 29, 2022

Is it safe to allow HTML uploads?

Related topics