Generated xml file is harmful for computer?

Question

I did an xml file and force download it by these headers:

header('Content-disposition: attachment; filename="export.xml"');
header('Content-type: application/xml; charset=utf8');
readfile('export.xml');

But before the download I see a dialog that this file can be harmful for my computer? How to get rid of this dialog? Maybe my headers is wrong?

upd Well, can do nothing, I did a test on my test-hosting, u can check it here: site with generation link, and an xml file as is: export.xml

Does your browser show the same message for all files that are to be downloaded? — Mikhail Vladimirov, Mar 07 '13 at 11:52
nope, just it, also I can open him without any risk through the real url in browser. — Smash, Mar 07 '13 at 11:54
possible duplicate of [php force download xml](http://stackoverflow.com/questions/2696500/php-force-download-xml) — Prasanth Bendra, Mar 07 '13 at 11:57
I took a headers from it. But there is no words about a harmful dialog. — Smash, Mar 07 '13 at 12:00
seems I need a whitelist of chrome's downaloadable files with risk. — Smash, Mar 07 '13 at 13:58

score 2 · Answer 1 · answered Mar 07 '13 at 11:55

2

Try changing application/xml to text/xml. Probably your browser thinks that application means executable.

answered Mar 07 '13 at 11:55

Mikhail Vladimirov

13,572
1
38
40

actually it was before, I thought that the browser doesn't like the `text/xml` header, no difference, still this dialog. – Smash Mar 07 '13 at 11:58

score 1 · Answer 2 · answered Mar 07 '13 at 11:56

1

Try this :

<?php 
header('Content-disposition: attachment; filename="export.xml"');
header('Content-type: "text/xml"; charset="utf8"');
readfile('export.xml');
?>

answered Mar 07 '13 at 11:56

Prasanth Bendra

31,145
9
53
73

hakre · Answer 3 · 2013-03-07T13:41:21.517

Note: This does not solve your issue, however it did solve an issue I had on my computer giving that notice (windows, chrome, apache webserver, PHP 5.4.10). I leave it here for future visitors.

Some browsers do not only look for the headers but also for the "filename" in the URL.

For example if you download a PHP file that contains XML, the browser might identify it as a dangerous file (because it can be executed on your system or is not within some whitelist or what not):

http://example.com/xml-download.php

A simple solution is to make this file not end with .php any longer, for example by adding a ?:

http://example.com/xml-download.php?

And continue with that to even signal the filename that way:

http://example.com/xml-download.php?export.xml

(the last one is not necessary but can be useful especially with some older browsers)

I dont know, but maybe this could be the answer: https://codereview.chromium.org/3899002/diff/5001/chrome/browser/download/download_exe.cc — Smash, Mar 07 '13 at 14:15
though, watch in bottom: http://src.chromium.org/viewvc/chrome/trunk/src/chrome/browser/download/download_exe.cc?view=markup&pathrev=63158 — Smash, Mar 07 '13 at 14:18

Generated xml file is harmful for computer?

3 Answers3