Opening uploaded html file link to browser causes browser to execute the javascript in the file #389

New Issue

michael · 2026-01-19T18:30:08Z

michael commented

2026-01-19 18:30:08 +00:00

Originally created by @minhaz1 on GitHub.

When you upload an html file and open the given url in the browser (tested on Chrome) the javascript that was in the file executes. For example, below I have an html file that redirects the user to another website, so when I open the link to the file on transfer.sh it ends up executing the redirect code instead of just showing me a preview.

Sample code:

<!DOCTYPE HTML>
<html lang="en-US">
    <head>
        <meta charset="UTF-8">
        <meta http-equiv="refresh" content="1;url=http://www.sample.com">
        <script type="text/javascript">
            window.location.href = "http://www.sample.com"
        </script>
        <title>Page Redirection</title>
    </head>
    <body>
        <!-- Note: don't tell people to `click` the link, just tell them that it is a link. -->
        If you are not redirected automatically, follow the <a href='http://www.sample.com'>link to sample</a>
    </body>
</html>

Originally created by @minhaz1 on GitHub. When you upload an html file and open the given url in the browser (tested on Chrome) the javascript that was in the file executes. For example, below I have an html file that redirects the user to another website, so when I open the link to the file on transfer.sh it ends up executing the redirect code instead of just showing me a preview. Sample code: ``` <!DOCTYPE HTML> <html lang="en-US"> <head> <meta charset="UTF-8"> <meta http-equiv="refresh" content="1;url=http://www.sample.com"> <script type="text/javascript"> window.location.href = "http://www.sample.com" </script> <title>Page Redirection</title> </head> <body>  If you are not redirected automatically, follow the <a href='http://www.sample.com'>link to sample</a> </body> </html> ```

michael closed this issue

2026-01-19 18:30:08 +00:00

michael commented

2026-01-19 18:30:09 +00:00

@nl5887 commented on GitHub:

Good one, will fix this.

@nl5887 commented on GitHub: Good one, will fix this.

michael commented

2026-01-19 18:30:09 +00:00

@johnko commented on GitHub:

-content = html_template.HTML(fmt.Sprintf("<pre>%s</pre>", data))
+content = html_template.HTML(fmt.Sprintf("<pre>%s</pre>", html.EscapeString(data)))

@johnko commented on GitHub: ``` -content = html_template.HTML(fmt.Sprintf("<pre>%s</pre>", data)) +content = html_template.HTML(fmt.Sprintf("<pre>%s</pre>", html.EscapeString(data))) ```

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: dutchcoders/transfer.sh#389