Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

If I'm given a URL that points to a .txt file, is it always safe to open it? Can it possibly contain virus or malicious content?

share|improve this question

2 Answers

up vote 7 down vote accepted

A file named .txt, can still have a "dangerous" content type. E.g. Apache allow you to set "Content-Type: text/html" on .txt files (or to what ever on what ever). A file with content-type "text/html" will be rendered as a html page in the browser.

share|improve this answer
This is a good answer and is a typical audit test. Load a simple script tag into a text document with an alert, load it to your host and open it via the browser. Since the type is text/html, in many browsers the JS will execute and may be malicious in nature. (That said, the mime type could be anything, but this is an example of why one has to be careful of how they redisplay uploaded files). – iivel Oct 19 '12 at 22:23
For this matter, so can any document on the entire Internet. – Stephen Touset Oct 19 '12 at 23:37
up vote 3 down vote

It is not safe. It can be malicious.

The last four characters of the URL being ".txt" has no actual significance to the type of file that is sent to your browser, and in most cases won't affect how it handles the file. The important part is the Content-Type header of the HTTP response. http://foo.com/bar.txt could easily be a web page, or a flash video, or an mp3 file, or a java applet, or any of a hundred other things. I am sure you have been to plenty of web pages that don't end in ".html" (like the one you're reading this on right now).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.