Sharpreader and IE security zones

by Matt 15. February 2007 18:13

A little while ago, I pontificated that the simple way to solve security problems with feeds containing scripts and activex controls was to display the feed content in an IE browser window set to the security zone of the url of that item. I also noted that the latest version of Sharpreader displays items in the restricted zone.

Tonight, I just happened to be spelunking in the Sharpreader code base (don't ask - Reflector is just too easy a tool to reach for) and came across the method used. Instead of setting the zone of the IE control, it instead sets all URLs that come from 127.0.0.1 as being in the restricted zone. This affects all programs for the current user. A little heavy handed, but it gets the job done.

It's all done through registry settings, a method I hadn't seen before. So, for future reference, here's the knowledge base article that describes what's going on. (Sharpreader sets the Ranges value.)

(Incidentally, there's a rather sneaky flaw in my original argument. Unlike a web page, where the URL is an intrinsic value, an RSS item's URL is given to it in the RSS feed. Since it's not intrinsic, you can't necessarily trust it. You'd want to make sure that an RSS feed coming from evil.com that sets the URL of each of its items to update.microsoft.com - a default trusted site - doesn't get into the trusted zone. Similarly, an RSS feed coming from update.microsoft.com that has items with a URL of evil.com (for whatever reason) also shouldn't get the trusted zone. The algorithm to choose the URL to use for display would have to be smart about this. Perhaps get the zone of both URLs and pick the most restrictive? I'm not sure what the answer is here.)

Tags:

Comments (18) -

suv comparison
suv comparison
7/20/2011 10:36:12 PM #

Hi, just required you to know I he added your website to my Google bookmarks due to your layout. But seriously, I consider your net web-site has 1 in the freshest theme I??ve came across. It extremely helps make studying your blogging site significantly easier.

Reply

iphone 4 apps
iphone 4 apps
7/23/2011 7:38:43 PM #

Is it ok if I quote your article in my monthly newsletter? I would think this article suits my topic perfectly. Well ya, thanks for posting this article.

Reply

Joseph Vogel
Joseph Vogel United States
1/6/2016 2:18:23 PM #

Congrats! This is such a great website, I know it will translate well into book form. Which is AWESOME!

Reply

Natividad Sluder
Natividad Sluder United States
1/15/2016 4:34:15 AM #

getting the last pair of shoes in your size AWESOME!

Reply

Sharri Michonski
Sharri Michonski United States
1/15/2016 4:58:44 AM #

Printing out an essay or paper, reading the first line and realizing there aren't any mistakes.<br />AWESOME!

Reply

Micheline Trafton
Micheline Trafton United States
1/15/2016 5:45:26 AM #

Hey, congratulations Neil. This site really is something special and it's been a pleasure to share it with my readership too. Looking forward to future awesome things, and I'll send any suggestions that are sufficiently awesome.

Reply

Irvin Dewinter
Irvin Dewinter United States
1/15/2016 6:39:20 AM #

Congratulations, Neil! I love this site and I know I'll love the book. Christmas, birthdays, Father's Day 2010  check!

Reply

Chang Carbonneau
Chang Carbonneau United States
1/15/2016 7:48:56 AM #

getting the last pair of shoes in your size AWESOME!

Reply

Janine Norwood
Janine Norwood United States
1/15/2016 8:27:51 AM #

I can't wait to read this masterpiece. Ordering off the menu at fast food restaurants and old dangerous playground equipment have to be in the book!

Reply

Nana Szuszkiewicz
Nana Szuszkiewicz United States
4/2/2016 2:56:57 AM #

As I site possessor I believe the content matter here is rattling magnificent , appreciate it for your hard work. You should keep it up forever! Best of luck.

Reply

Anna Farris
Anna Farris United States
7/20/2016 7:43:10 AM #

Wow very thorough article. Thanks

Reply

Misty Kacik
Misty Kacik United States
7/20/2016 12:48:18 PM #

I will surely visit back for more –Great job!

Reply

Particia Morelli
Particia Morelli United States
8/13/2016 5:30:41 PM #

Until one day when, out of the blue, it hit me: "Why can I outsource BC Ecommerce, article writing, directory submissions and can't outsource window cleaning?". It took me a little math and a couple of phone calls to gain 5 important hours.

Reply

Giannell@gmail.com
Giannell@gmail.com United States
8/21/2016 8:13:40 AM #

Thanks for the auspicious writeup. It if truth be told used to be a enjoyment account it.

Reply

Funcionamiento de lavavajillas
Funcionamiento de lavavajillas United States
9/9/2016 4:32:54 PM #

Si en caso contrario surge una avería mas complicada como hace mucho ruido, pierde agua, no marcha, no enfría como debería, no gira, no lava de forma correcta, sale fuego, hecha chispas bien da calambre no importa para eso dispone de un número gratuito donde un personal entrenado le informara de todas y cada una sus opciones para la reparación de su electrodoméstico.

Reply

Gregory Despain
Gregory Despain United States
10/18/2016 2:39:40 AM #

Je suis souvent votre site et je le trouve parfait ! ;) continuez comme �a !

Reply

sexy teen virgins
sexy teen virgins United States
2/11/2017 7:48:22 PM #

You have made some really good points there. I looked on the net to learn more about the issue and found most individuals will go along with your views on this website.

Reply

dog tricks
dog tricks United States
3/5/2017 11:43:42 PM #

<a href="www.facebook.com/.../">american bullies</a>

Reply

Add comment

biuquote
  • Comment
  • Preview
Loading

Rel=Me

Month List

RecentComments

Comment RSS