Is wget'ing a single HTML file basically free of risk?

Question

There is a lot of potentially malicious stuff on the web. In fact, there are so many things that can happen that browsing to a location you know nothing about can be dangerous, like http://www.example.com/nasty.html

There may be scripts on the page, and a thousand other things. In essence, I may have forgotten to block everything.

I wonder, is it essentially free of risk to instead using wget from my terminal, like this:

wget "http://www.example.com/nasty.html"

And after that opening the file in a text editor? My understanding is that nothing then have a chance to load, but my knowledge here is blurry. Perhaps the server can trick my wget request? Or perhaps opening the file in a text editor is not a safe thing to do? I do not know, so therefore I am asking.

Answer 1

You are basically correct with a couple bits of complexity.

First, it is still possible that both wget or your text editor might have a vulnerability that the page could be designed to try and exploit. This is unlikely, and the malware author would have to predict that you would use this process and plant an ambush. Unlikely, but it still means that your process is not 100% fool-proof. Just something to keep in mind.

Second, it is possible for the webserver to identify that you are using wget, and serve you a non-nasty version of the file. This is quite easily done, with examples out there, by inspecting the user-agent. Again, this is not something that malicious actors think about, but it also means that you can't use wget and assume that the file you analyse will be the file you receive in your browser.

Yes, there are ways to modify wget's user-agent to lower this possibility, but, it's still something to think about.

So, yes, you are basically correct, but it is not a silver-bullet to secure yourself, and some risks remain.

Answer 2

I can think of three caveats.

1) Make sure the uploaded files dont end up somewhere where they can be executed. (eg your web server folder) Otherwise scripts (for example php) can be uploaded and called/executed through the web server.

2) Continuing on this line of thinking, I think the webserver MAY dictate the filename if not set explicitly by wget. Thus allowing the source to give the file an extention such as .php

3) You might be fed a file so big, you might run out of resources (disk space, data plan), that it brings your server down.