Page MenuHomePhabricator

Blacklist .mht and .mhtml extensions
Closed, ResolvedPublic

Description

Author: ekb87ds02

Description:
Here's another useful Internet Explorer extension: mhtml, or mht for short.
These are html and supporting files in a container.

I'm not sure if internet explorer considers these to be in the same domain as
the webpage hosting it (for xss purposes), but mediawiki should probably have
this file type in its default blacklist anyway.

Most of these files start with an html file, so they are caught by the filter
that searches the first part of the file for html code. It can contain anything
though, so it might start with for instance an image, so it wouldn't be caught.


Version: unspecified
Severity: enhancement

Details

Reference
bz8989

Event Timeline

bzimport raised the priority of this task from to Medium.Nov 21 2014, 9:33 PM
bzimport set Reference to bz8989.
bzimport added a subscriber: Unknown Object (MLST).

lcarsdata wrote:

Adds mhtml, mhtm, and mht to the default file blacklist

This patch adds mhtml, mhtm and mht. I have added mhtm just in case as this is
in a similar form to htm and may be used in future.

Attached: