Am I gonna run into XSS attacks by doing this, or will a file download be prompted?
Are there security problems that would rise in a modern browser?
The text/plain->text/html content-type-sniffing issue mentioned by curiousguy is the most likely attack, but there are also many more cases where browsers and plugins do content-sniffing; often these are immune to
For example the
The only sure-fire way to serve arbitrary untrusted content without being at risk of XSS is to serve it from a different domain* that doesn't share an origin with your main site.
*: variants: full different second-level domain with different IP address is tightest. There are issues with applets being able to make network connections to the same IP address even if the domain is different under Java. Using a subdomain may be OK subject to limitations - if it's
Some very badly broken browsers (notably old IE versions) try to "snif" the "true" content-type and will act as if the content-type was
If you want the browser to save the file instead of display it, try
You can also use the