Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Outlook by default blocks .url attachments and not .htm – why?

Any dangerous URL that could be in .url file, could also easily be in a .htm file and could be launched using javascript automatically. I see the same risk with both attachments, but Microsoft treats it differently. Am I missing something here? How is a .htm file safer than .url?

What else could be in .url file that a hacker could not put in .htm file?

share|improve this question

migrated from Sep 14 '11 at 9:37

This question came from our site for professional and enthusiast programmers.

Maybe there is a known vulnerability with .url files which would cause contained data to be interpreted without user interaction. – Oliver Salzburg Feb 28 '12 at 12:59

You can disable scripts and redirects through browser security settings if you desire to do so.

You'd need to disable .url file support completely for some protection against those.

share|improve this answer

You must log in to answer this question.