Gmail to block JavaScript file attachments on February 13; Google says .js files can still be sent using Google Drive and Google Cloud Storage
Gmail currently restricts certain file attachments (e.g. .exe, .msc, and .bat) for security reasons, and starting on February 13, 2017, we will not allow .js file attachments as well.
Context & Ripple Effects
Gmail has been ratcheting up its attachment blacklist for years — .exe, .msc, and .bat were already blocked — and adding .js extends that list to the file type most commonly used to smuggle script-based malware past filters. The move continues a hardening arc that began with Gmail adopting Content Security Policy support back in 2014 to stop unsafe code loading.
The escape hatch is the telling part: Google says .js files can still be sent through Google Drive and Google Cloud Storage, meaning the block doesn't ban the file type so much as reroute it through Google's own infrastructure.
First-order effects
- Developers and technical users who legitimately email .js source files must switch to Drive or Cloud Storage links by February 13, or their messages will bounce.
- Malware campaigns that relied on emailing raw .js attachments directly to victims lose their simplest delivery channel inside Gmail.
Second-order effects
- File-sharing traffic shifts onto Google Drive and Cloud Storage, where Google can scan, log, and control access — deepening dependence on its storage services for anything email used to carry.
- IT administrators mirroring Gmail's blocked-file list have one more type to add, and security teams gain a precedent for treating script files as attachments-to-ban rather than attachments-to-scan.
Third-order effects
- The pattern points to email providers acting as de facto gatekeepers of what files may transit the network at all — a posture Google extended later by restricting third-party developer access to Gmail after the Google+ data leak and by adopting transport-level standards like MTA-STS and TLS Reporting.
- If blocking-plus-rerouting becomes the default response to risky file types, attachment security consolidates around whichever cloud storage the mail provider owns, rather than around endpoint antivirus.
The trend: Email is shifting from a neutral file-transport layer to a security-controlled gateway, with risky attachments pushed onto the provider's own scanned cloud storage.