htmlgoogle-docsgoogle-document-viewer

Google Docs Viewer for rendering HTML


I'm using Google Docs Viewer (https://docs.google.com/viewer) to display the contents of documents in my app. I support many different types of document (e.g. PDF, Microsoft Word, Plain Text, HTML, etc.). Everything works well except for HTML. Google Docs Viewer treats HTML as text and displays the source.

Is there any way to get Google Docs Viewer to render the HTML?

Here's an example: https://docs.google.com/viewer?url=http%3A%2F%2Fwww.google.com&embedded=true

Instead of rendering the Google home page, it shows the HTML mark-up.

I'm hoping I can use the Google Docs Viewer for all types of documents and not have to treat HTML differently.


Solution

  • Imagine an attacker uploads an HTML file of google's sign page

    enter image description here

    Makes the html public and sends it over the email to your gf with the subject

    Flash Fashion Sale Discount Coupons

    Your gf will obvious click the link and won't be surprised to see Fake google sign in page on a docs.google.com domain .

    She will convincingly enter her real credentials and will be redirected to attacker's server and then some real google docs page to remove suspicion.

    So to prevent users from phishing attacks google stopped rendering HTMLS

    source