# Is it safe to allow HTML uploads? (2023)
**URL:** \
**Category:** Product Support\
**Created:** [November 15, 2023, 10:57pm UTC](https://meta.discourse.org/t/is-it-safe-to-allow-html-uploads-2023/285629 "2023-11-15T22:57:45Z")\
**Posts on this page:** 1\
**Showing post:** 1
**Author:**  [@dfabulich](https://meta.discourse.org/u/dfabulich)\
**Post date:** [November 15, 2023, 10:57pm UTC](https://meta.discourse.org/t/is-it-safe-to-allow-html-uploads-2023/285629/1 "2023-11-15T22:57:45Z")
Continuing the discussion from [Is it safe to allow HTML uploads?](https://meta.discourse.org/t/is-it-safe-to-allow-html-uploads/136797):
> [@Is it safe to allow HTML uploads?](https://meta.discourse.org/t/is-it-safe-to-allow-html-uploads/136797/1):
>
> As far as I can see the uploaded HTMLs are just downloaded as normal files (e.g. archives or PDFs), so it’s up to the user and the browser settings (open automatically after download, …) whether to open them.
>
> But this topic mentions something about XSS…
>
> > [@](#):
> >
> > If I can upload an HTML page I can do what’s called a Cross Site Scripting (XSS) attack, as some browsers will render gifs as HTML. [Neal Poole from Facebook wrote about a Wordpress vuln like this back in 2011](https://nealpoole.com/blog/2011/04/file-upload-xss-vulnerability-in-wordpress/) The HTML file could have javascript in it, which I could use to do bad things. Again, I’m not a security researcher (though that’s what our community is made up of), so I can’t speak at length about XSS or test this thoroughly. I’m just wondering if you guys do anything to check headers o…
>
> As I understand there is no way to interact with the Discourse page from the downloaded file?
> So the worst it can do is show some kind of phishing content.
Responses in the thread were of the form “why would you ever want this?” I have an answer.
Our forum is dedicated to the development of web-based games. I’d like our users to be able to distribute their games to each other using the forum. (But _not_ if it will cause an XSS attack.)
As long as uploaded HTML files always have “Content-Disposition: attachment” (as it appears they do), I’m not aware of any XSS attack that this would enable, or even a novel phishing attack. Links to the HTML file will force it to be downloaded, not opened directly on the forum’s site.
(I note that Gmail allows users to download HTML file attachments; it seems fine.)
Of course, phishing attacks _can_ be extremely simplistic. Today, anyone at TL1 could just DM a forum user and say, “Hi, I’m this forum’s administrator. Please send me your password.” Similarly, they can already create a website at `evil.example.com` that’s designed to look exactly like the forum’s login page, and they could try to trick users into clicking that link and typing their password in there.
I guess they could _also_ try to do it with an attachment, saying “Hi, I run this forum, please download this file and open it, OK?” and that file might include a mockup of the forum’s login page.
But downloading an HTML file and double clicking it wouldn’t be any more dangerous from a phishing perspective than allowing users to click a link to an evil website. And, since it’s more complicated, it will probably fool fewer users than just sending out links to a phishing site (the traditional way).
Sooo _is_ there an XSS risk here? Or a subtle phishing attack I’m not aware of?
---
_[View the full topic](https://meta.discourse.org/t/is-it-safe-to-allow-html-uploads-2023/285629)._