User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:33.0) Gecko/20100101 Firefox/33.0 Build ID: 20141013195847 Steps to reproduce: It is possible to open a new bug on bugzilla and add attachments html and xml with malicious javascript code in it. I don't know if this issue has been already reported. Actual results: You can redirect the user which opens the attachment to a different site, probably steal his session cookie as well [not tested]. Expected results: malicious files should be showed as plain text no matter what no? :)

this file will redirect the user to yahoo.com

as bugzilla.mozilla.org is used to track browser development, it would be high detrimental to productivity if we always rendered attachments as text/plain. instead we serve attachments from a different subdomain; they don't have access to bugzilla's cookies.