0

i have a blog comment section where users write their website and a comment about it and it is shown like this

<a href="https://example.com">Website</a>
<br>
<span>my website is about...</span>
<br><br>
<a href="https://example2.com">Website2</a>
<br>
<span>my website2 is about...</span>

and i allow http/https url schemes only

some of my users told me they want to write a website or a connection using url schemes like ftp:// - mailto: - file: - info: to use them as

<a href="ftp://example.com">Website</a>
<br>
<span>my website is about transfering to you</span>
<br><br>
<a href="file:example2.com/file.xml">Website2</a>
<br>
<span>my website2 is about sharing a file link to download</span>
<br><br>
<a href="mailto:[email protected]">Website2</a>
<br>
<span>my website3 is to send me email for medical conditions</span>

is it safe for the viewer to allow this or it maybe dangers their privacy and security by suprise?

Improve this question
5
  • 1
    What will you do to guarantee that the links to files/ftp aren't malware?
    – Trebor
    Commented Apr 26, 2020 at 14:39
  • @Trebor i thought of that but can malware be executed from these links unless opened?
    – Joe Doe
    Commented Apr 26, 2020 at 14:41
  • 1
    If a user clicks on a link to a MS Word or Excel file that contains malware, most client computers will automatically open the file, triggering the malware.
    – Trebor
    Commented Apr 26, 2020 at 15:05
  • @Trebor that mean all website giving MSWord Excelt download are also dangerious ?
    – Joe Doe
    Commented Apr 26, 2020 at 15:10
  • They're all at risk. Even Intel, the chip manufacturer, had a file years ago that contained a virus that spread when users opened the file. It wasn't on purpose, but somehow got into production. I will always scan docs for viruses/malware prior to opening if they don't come from a super reliable source.
    – Trebor
    Commented Apr 26, 2020 at 15:55

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.