Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Outlook by default blocks .url attachments and not .htm – why?

Any dangerous URL that could be in .url file, could also easily be in a .htm file and could be launched using javascript automatically. I see the same risk with both attachments, but Microsoft treats it differently. Am I missing something here? How is a .htm file safer than .url?

What else could be in .url file that a hacker could not put in .htm file?

share|improve this question

migrated from stackoverflow.com Sep 14 '11 at 9:37

This question came from our site for professional and enthusiast programmers.

Maybe there is a known vulnerability with .url files which would cause contained data to be interpreted without user interaction. –  Oliver Salzburg Feb 28 '12 at 12:59

1 Answer 1

You can disable scripts and redirects through browser security settings if you desire to do so.

You'd need to disable .url file support completely for some protection against those.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.