MHTML

The header of an MHTML file contains metadata such as a date and time stamp, page title, the source URL, and a unique randomized boundary string for separating resources contained within the file. The boundary string is defined at the beginning and used throughout the file. From: Snapshot-Content-Location: https://en.wikipedia.org/wiki/Smartphone Subject: Smartphone - Wikipedia Date: Sat, 24 Sep 2022 00:34:32 -0000 MIME-Version: 1.0 Content-Type: multipart/related; type="text/html"; boundary="----MultipartBoundary--GsIBda0vjy2AKIAIliwl7JMwezXDRjDAsLje9khd5l----" Then, the page resources are contained sequentially, starting with the page's rendered HTML source code. Each resource has its own metadata header which specifies its MIME type and the original location. ------MultipartBoundary--GsIBda0vjy2AKIAIliwl7JMwezXDRjDAsLje9khd5l---- Content-Type: text/html Content-ID: Content-Transfer-Encoding: binary Content-Location: https://en.wikipedia.org/wiki/Smartphone The MHTML file ends with a boundary string that is not followed by any data. == MIME type ==

MIME type for MHTML is not well agreed upon. Used MIME types include: • multipart/related • application/x-mimearchive • message/rfc822 == Supporting apps ==

Web browsers Some browsers support the MHTML format, either directly or through third-party extensions, but the process for saving a web page along with its resources as an MHTML file is not standardized. Due to this, a web page saved as an MHTML file using one browser may render differently on another. • Internet Explorer 5 was the first browser to support reading and saving web pages and external resources to a single MHTML file. • Microsoft Edge, after switching to the Chromium source code, supports saving web pages as MHTML. • Opera: Support for saving web pages as MHTML files was made available in the Opera 9.0 web browser. From Opera 9.50 through the rest of the Presto-based Opera product line (version 12.16 as of 19 July 2013), the default format for saving pages is MHTML. The initial release of the new Webkit/Blink-based Opera (version 15) did not support MHTML, but subsequent releases (16 and later) do. MHTML can be enabled by typing "opera://flags#save-page-as-mhtml" at the address bar. • Google Chrome 86 and later can create MHTML files. • Yandex Browser 22.7.4.960 (July 2022) and later can create MHTML (multipart/related) files. • Vivaldi 2.3 and later can create MHTML files. It supports both reading and writing MHTML files by toggling the "vivaldi://flags/#save-page-as-mhtml" option. • Firefox does not support MHTML. Until version 57 ("Firefox Quantum"), two browser extension, Mozilla Archive Format or UnMHT, could read and write MHTML files. These extensions are incompatible with version 57 and later. • Safari 3.1.1 and later terminated native support for the MHTML format. Instead, the browser supports the Web Archive format. The macOS version includes a print-to-PDF feature. As with most other modern web browsers, support for MHTML files can be added to Safari via various third-party extensions. • Konqueror 3.5.7 and later terminated support for MHTML files. An extension project, mhtconv, can be used to allow saving and viewing of MHTML files. • NetFront 3.4 (on devices such as the Sony Ericsson K850) can view and save MHTML files. • Pale Moon requires an extension to be installed to read and write MHT files. One extension is freely available, MozArchiver, a fork of Mozilla Archive Format extension. • GNOME Web added support for read and save web pages in MHTML since version 3.14.1 released in September 2014. Other apps • Problem Steps Recorder for Windows can save its output to MHT format. • The "Save to Google Drive" extension for Google Chrome can save as MHTML as one of its outputs. • Microsoft OneNote 2010 and later can email individual pages as .mht files. • Evernote for Windows can export notes as MHT format, as an alternative to HTML or its own native .enex format. == Exploits ==

In May 2015, a researcher noted that attackers could build malicious documents by creating an MHT file, appending an MSO object at the end (MSO is a file format used by the Microsoft Outlook e-mail application), and renaming the resulting file with a .doc extension. The delivery method would be by spam emails. In April 2019, a security researcher published details about an XML external entity (XXE) vulnerability that could be exploited when a user opens an MHT file. Since the Windows operating system is set to automatically open all MHT files, by default, in Internet Explorer, the exploit could be triggered when a user double-clicked on a file that they received via email, instant messaging, or another vector, including a different browser. == Alternatives ==

Data URI scheme The data URI scheme offers an alternative for including separate elements such as images, style-sheets and scripts in-line when serving an HTML request or saving an HTML resource for offline use. Like the embedded content within MHTML, data URIs use Base64 encoding of the external resources (which may be binary or text) to embed them in-line within the HTML markup. HTML pages saved with external elements embedded using the data URI scheme are standard web pages, and can be opened by any modern browser, including browsers not supporting MHTML such as Mozilla Firefox. Unlike MHTML, saving web pages with their external resources embedded using data URIs requires a third-party extension to be installed in the browser. Mozilla Archive Format The Mozilla Archive Format (MAFF) is a legacy Web archive file format that was supported by Firefox from 2004 to 2018 through an add-on. Unlike both MHTML and data URIs, MAFF uses a ZIP container to preserve both the HTML file and its external elements. In October 2017 the add-on developer announced the format would no longer be supported in future versions of Firefox. == See also ==