10

Our SaaS web application uses MHT files for user-created templates.

Recently, Chrome started blocking the downloads, showing the following message: blocked

This obviously frightens users, and requires some awkward steps to work around, even for a tech-savvy person.

IE 11 and Firefox 39 don't have any problem with that file.

Is there a way to prevent this problem that's easier than rewriting our application to stop using MHT files?

Diego Mijelshon
  • 52,548
  • 16
  • 116
  • 154
  • FWIW, I know some of the mht files I have include some calls to Outlook extensions like WebEx. At first I thought it was blocking these because it saw them as 'executable', but it is definitely all of my mht files, even just plain text and images. – Jon Sep 08 '15 at 14:13
  • I created an empty file with `.mht` extension and chrome doesn't let me to download it.They do have an API `chrome.pageCapture.saveAsMHTML` to capture page. And they simply don't let you save captured page with right extension. So sad. – Dizzy Feb 21 '16 at 01:39
  • I know this is an old question, but for any others who found this looking for **Outlook** `.mht` workarounds, try using `.eml` extension instead – jg2703 Apr 04 '19 at 14:23

4 Answers4

2

The workaround was to use a doc extension instead of mht, even though the file is really a mht. Word will silently open it, and save it in the same format by default.

Diego Mijelshon
  • 52,548
  • 16
  • 116
  • 154
1

Unfortunately, the only solution I've found is to open chrome://settings, click advanced settings, under Privacy, deselect "Protect you and your device from dangerous sites"

Ben
  • 11
  • 2
  • 1
    Unfortunately: 1) That would be a terrible idea, because there *are* lots of actually dangerous files. 2) SaaS, not enterprise. We can't tell a thousand users around the world to change their browser settings to use our app. – Diego Mijelshon Aug 06 '15 at 23:07
  • As of version 87.0.4280.88 disabling has no effect on this behavior in respect to eml or mht file extensions. It's a very real and unacceptable problem for us as well. – kevin walker Dec 09 '20 at 16:24
1

There IS a workaround, but it more work than it should be:

When you see the download bar shown in the question above, click on the far right where it says Show all downloads

On the blocked file click Recover malicious file, then Show in folder. You can now view the file in your downloads folder. A little laborious, but definitely works.

Credit goes to Lifehacker comments:

http://lifehacker.com/chromes-safe-browsing-blocks-expanded-to-deceptive-do-1622139001#reply_1622302969 (Edit #2)

Jon
  • 1,820
  • 2
  • 19
  • 43
  • that is not useful for our case. I know how to do it (it probably took me about a minute to figure out), but I can't expect end users to do that as part of normal application use. I'm currently rewriting that module to work with DOCX files instead. – Diego Mijelshon Sep 08 '15 at 14:14
0

There's a workaround I've found that allows you to open .mht links from the web in a new Chrome tab:

  1. Install the "IE Tab" Chrome plugin
  2. Right click on the IE Tab icon in the Chrome tool bar and choose "IE Tab Options" -> "Options"
  3. Enable (click the checkbox) for the "Enable Auto URLs" option
  4. To allow .mht files to automatically download when clicked upon in Chrome, add the most specific URL you can come up with to the "Auto URLs" section of the IE Tab settings. For example, "http://your-trusted-intranet-server.your-company.com/*.mht"
  5. Close the IE Tab options page

If you then want them to automatically open in a Chrome tab, you'll need to do the following steps in addition:

  1. Download a .mht file to your local disk.
  2. Right-click on it and choose "Open With".
  3. Enable (Check the box) for the option that says "Always use this app to open .mht files".
  4. Choose chrome.exe, or use the "choose another app" option and navigate to "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" (or wherever Chrome is installed on your PC)
  5. Go back to the IE Tab options page, and add the most specific local-disk URL you can come up with that matches where the .mht files are downloaded to by IE Tab when you click on them. For example, "file:///C:/Users/your_name/AppData/Local/Microsoft/Windows/INetCache/*.mht"
  6. Close the IE Tab options page

At this point, when you click on a .mht URL matching the wildcard you've set up in step (5), you should see a tab open in chrome, and a dialog will ask you if you want to open the file. Click "Open" and the file will open in Chrome, using an embedded IE instance running in the Chrome tab.

This only works on Windows PCs (because it allows an IE instance to run inside a Chrome web page), but that's good enough for my requirements.

Chris Kline
  • 2,249
  • 26
  • 32
  • This does not solve the problem, which is not about *me* downloading a MHT file, but my SaaS users. – Diego Mijelshon Dec 10 '15 at 14:46
  • Yes, unfortunately it does not solve the problem at the application level. But until Google gives Chrome the ability to whitelist URLs, this may be the best workaround available to your customers. It may even be something their IT department can automatically deploy. – Chris Kline Dec 10 '15 at 14:49
  • SaaS means Software as a Service. There's no IT department here - users of the app from different organizations around the world can use any supported browser in any platform. Whitelisting would not work either. – Diego Mijelshon Dec 10 '15 at 14:51
  • 1
    I'm familiar with the acronym; I developed this workaround for use with a SaaS product our organization uses. I'm sorry it is not a viable workaround for use with your product, but hopefully it may be of use to others. – Chris Kline Dec 10 '15 at 14:59