The attack is something like this:

• You upload a .html page to Phabricator containing some malicious Javascript.
• You somehow get your victim to visit the page and execute the HTML in their browser while logged out. This is normally difficult because we try very hard to prevent this, but not necessarily impossible since browsers tend to want to execute HTML and Javascript. For example, earlier versions of Safari on iPad ignored Content-Disposition: attachment and would execute (instead of downloading) HTML files.

When the user visits and executes your page:

• You set their phsid (session) cookie to your session cookie.
• On the server, Phabricator can't distinguish between the valid phsid cookie it set and the copy of the phsid cookie your evil page added, so this is treated as a valid phsid cookie and your victim is now logged into an account you control.
• Through social engineering, you now somehow get them to enter something super secret into Phabricator, not noticing that you've logged them in as you and believing they are entering the data into their own account.
• Since you control the account they're actually logged into, you can later go retrieve the data?

I think this is an acceptable risk since:

• Getting the victim to execute the script is hard.
• Getting them to enter secret data and not notice that they're logged in as someone else also seems hard.
• This attack is completely defused by following setup advice and configuring an alternate file domain.
• This attack might be possible anyway, whether we allow these public GET requests or not, depending on how you're tricking the script into executing.