Hacker News Reader

Comment by nemetroid | Hacker News Reader

The complaint is about documents exported from Google Docs.

Expecting an exported document to behave as close as possible as the hosted version is not exactly unreasonable in general.

When I paste a link in Google Docs, the UI tells me that it's preserving the link I pasted. Now, if it converted http://example.com to a google redirect link in the doc, then I probably would not be surprised to see it show up the same way in my export.

But thats still a malware vector right?, especially if you can get the victim to export it themselves?

It is not. There is no sense at all: you could use manually crafted HTML page with malicious links, there is no benefit in using Google Docs export for this.

The benefit is as OP said: it bypasses corporate firewalls because it's a google doc.

Although I can only reproduce this redirect page in a published doc page[0], not in a pdf export (unless there's another way to download pdf via url trickery)

0: https://docs.google.com/document/d/e/2PACX-1vR4O-8LwvUPNOcwH...

A HTML file exported from google docs is not a google doc and I don't see how or why a firewall would see it as one?

The URL to download the export can't be shared as far as I can tell.

edit: you can reuse the URL to download the export. tested on another network. it expires fairly quickly though, within a couple minutes it seems.

> edit: you can reuse the URL to download the export. tested on another network. it expires fairly quickly though, within a couple minutes it seems.

(thanks for the test) So it's clearly not a possible real vector, and actually they thought about it being a possible vector, otherwise they would not have put the expiration.

I could reproduce on HTML ZIP export but not PDF.

The malware vector still exists because you can just edit the file exported and change the links... bad actors laugh out loud at these issues.

The person doing the export isn't necessarily the bad actor.

That's for sure, but what attack vectors do you imagine? If the bad actor, for example, is the owner of the document it can easily put a link to a malware that Google will not detect.

Oh, you're right! And by that logic, Hacker News is a malware vector, too, with all these random links hanging around. Maybe we should petition the moderators to integrate Google's tracking links here as well!

You can write HTML (or Word, or whatever) yourself w/o Google's help. This "feature" isn't going to stop malware links on exported google docs.

Reply on news.ycombinator.com