i have a blog comment section where users write their website and a comment about it and it is shown like this

<a href="https://example.com">Website</a>
<span>my website is about...</span>
<a href="https://example2.com">Website2</a>
<span>my website2 is about...</span>

and i allow http/https url schemes only

some of my users told me they want to write a website or a connection using url schemes like ftp:// - mailto: - file: - info: to use them as

<a href="ftp://example.com">Website</a>
<span>my website is about transfering to you</span>
<a href="file:example2.com/file.xml">Website2</a>
<span>my website2 is about sharing a file link to download</span>
<a href="mailto:name@example3.com">Website2</a>
<span>my website3 is to send me email for medical conditions</span>

is it safe for the viewer to allow this or it maybe dangers their privacy and security by suprise?

  • 1
    What will you do to guarantee that the links to files/ftp aren't malware? – Trebor Apr 26 '20 at 14:39
  • @Trebor i thought of that but can malware be executed from these links unless opened? – Joe Doe Apr 26 '20 at 14:41
  • 1
    If a user clicks on a link to a MS Word or Excel file that contains malware, most client computers will automatically open the file, triggering the malware. – Trebor Apr 26 '20 at 15:05
  • @Trebor that mean all website giving MSWord Excelt download are also dangerious ? – Joe Doe Apr 26 '20 at 15:10
  • They're all at risk. Even Intel, the chip manufacturer, had a file years ago that contained a virus that spread when users opened the file. It wasn't on purpose, but somehow got into production. I will always scan docs for viruses/malware prior to opening if they don't come from a super reliable source. – Trebor Apr 26 '20 at 15:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.