Sharpreader and IE security zones

by Matt 15. February 2007 18:13

A little while ago, I pontificated that the simple way to solve security problems with feeds containing scripts and activex controls was to display the feed content in an IE browser window set to the security zone of the url of that item. I also noted that the latest version of Sharpreader displays items in the restricted zone.

Tonight, I just happened to be spelunking in the Sharpreader code base (don't ask - Reflector is just too easy a tool to reach for) and came across the method used. Instead of setting the zone of the IE control, it instead sets all URLs that come from 127.0.0.1 as being in the restricted zone. This affects all programs for the current user. A little heavy handed, but it gets the job done.

It's all done through registry settings, a method I hadn't seen before. So, for future reference, here's the knowledge base article that describes what's going on. (Sharpreader sets the Ranges value.)

(Incidentally, there's a rather sneaky flaw in my original argument. Unlike a web page, where the URL is an intrinsic value, an RSS item's URL is given to it in the RSS feed. Since it's not intrinsic, you can't necessarily trust it. You'd want to make sure that an RSS feed coming from evil.com that sets the URL of each of its items to update.microsoft.com - a default trusted site - doesn't get into the trusted zone. Similarly, an RSS feed coming from update.microsoft.com that has items with a URL of evil.com (for whatever reason) also shouldn't get the trusted zone. The algorithm to choose the URL to use for display would have to be smart about this. Perhaps get the zone of both URLs and pick the most restrictive? I'm not sure what the answer is here.)

Tags:

Comments (31) -

suv comparison
suv comparison
7/20/2011 10:36:12 PM #

Hi, just required you to know I he added your website to my Google bookmarks due to your layout. But seriously, I consider your net web-site has 1 in the freshest theme I??ve came across. It extremely helps make studying your blogging site significantly easier.

Reply

iphone 4 apps
iphone 4 apps
7/23/2011 7:38:43 PM #

Is it ok if I quote your article in my monthly newsletter? I would think this article suits my topic perfectly. Well ya, thanks for posting this article.

Reply

Joseph Vogel
Joseph Vogel United States
1/6/2016 2:18:23 PM #

Congrats! This is such a great website, I know it will translate well into book form. Which is AWESOME!

Reply

Natividad Sluder
Natividad Sluder United States
1/15/2016 4:34:15 AM #

getting the last pair of shoes in your size AWESOME!

Reply

Sharri Michonski
Sharri Michonski United States
1/15/2016 4:58:44 AM #

Printing out an essay or paper, reading the first line and realizing there aren't any mistakes.<br />AWESOME!

Reply

Micheline Trafton
Micheline Trafton United States
1/15/2016 5:45:26 AM #

Hey, congratulations Neil. This site really is something special and it's been a pleasure to share it with my readership too. Looking forward to future awesome things, and I'll send any suggestions that are sufficiently awesome.

Reply

Irvin Dewinter
Irvin Dewinter United States
1/15/2016 6:39:20 AM #

Congratulations, Neil! I love this site and I know I'll love the book. Christmas, birthdays, Father's Day 2010  check!

Reply

Chang Carbonneau
Chang Carbonneau United States
1/15/2016 7:48:56 AM #

getting the last pair of shoes in your size AWESOME!

Reply

Janine Norwood
Janine Norwood United States
1/15/2016 8:27:51 AM #

I can't wait to read this masterpiece. Ordering off the menu at fast food restaurants and old dangerous playground equipment have to be in the book!

Reply

Nana Szuszkiewicz
Nana Szuszkiewicz United States
4/2/2016 2:56:57 AM #

As I site possessor I believe the content matter here is rattling magnificent , appreciate it for your hard work. You should keep it up forever! Best of luck.

Reply

Anna Farris
Anna Farris United States
7/20/2016 7:43:10 AM #

Wow very thorough article. Thanks

Reply

Misty Kacik
Misty Kacik United States
7/20/2016 12:48:18 PM #

I will surely visit back for more –Great job!

Reply

Particia Morelli
Particia Morelli United States
8/13/2016 5:30:41 PM #

Until one day when, out of the blue, it hit me: "Why can I outsource BC Ecommerce, article writing, directory submissions and can't outsource window cleaning?". It took me a little math and a couple of phone calls to gain 5 important hours.

Reply

Giannell@gmail.com
Giannell@gmail.com United States
8/21/2016 8:13:40 AM #

Thanks for the auspicious writeup. It if truth be told used to be a enjoyment account it.

Reply

Funcionamiento de lavavajillas
Funcionamiento de lavavajillas United States
9/9/2016 4:32:54 PM #

Si en caso contrario surge una avería mas complicada como hace mucho ruido, pierde agua, no marcha, no enfría como debería, no gira, no lava de forma correcta, sale fuego, hecha chispas bien da calambre no importa para eso dispone de un número gratuito donde un personal entrenado le informara de todas y cada una sus opciones para la reparación de su electrodoméstico.

Reply

Gregory Despain
Gregory Despain United States
10/18/2016 2:39:40 AM #

Je suis souvent votre site et je le trouve parfait ! ;) continuez comme �a !

Reply

sexy teen virgins
sexy teen virgins United States
2/11/2017 7:48:22 PM #

You have made some really good points there. I looked on the net to learn more about the issue and found most individuals will go along with your views on this website.

Reply

dog tricks
dog tricks United States
3/5/2017 11:43:42 PM #

<a href="www.facebook.com/.../">american bullies</a>

Reply

Yahaira Delashmit
Yahaira Delashmit United States
4/12/2017 3:52:49 AM #

? For the places that mention they are pet-friendly, visit them. If you find one or two you like, check out other facilities if they're in perfect working order. Is the house near your work place or your kids' school? Consider other important factors. Don't be afraid to ask the owner.

Reply

Lesia Gasca
Lesia Gasca United States
5/25/2017 6:55:12 AM #

Excellent weblog here! Additionally your website rather a lot up fast! What host are you the usage of? Can I get your associate link for your host? I wish my website loaded up as quickly as yours lol

Reply

Tania
Tania United States
9/30/2018 1:42:56 AM #

tienes canal de youtube?

Reply

comprar seguidores
comprar seguidores United States
9/30/2018 11:22:24 AM #

comprar reproducciones

Reply

高質數網頁設計
高質數網頁設計 United States
10/8/2018 4:42:08 AM #

Photoshop 教學導覽

Reply

高能聚焦量超聲波( HIFU )以物理性聚焦集中成一點, 快速穿透皮膚真皮及脂肪層面直達面部表淺肌肉腱膜系統( SMAS )層令其組織細胞分子高速磨擦 , 瞬間升溫至60 -70 度,令整個表淺肌肉腱膜系統( SMAS )受熱收縮,形成熱固化區域, 令結綈組織同時拉緊,達到拉皮防皺及美容效果。SMAZ聚焦超聲波提供了最有效的HIFU能量收緊皮膚及刺激胶原蛋白新生,提升彈性,恢復更緊緻的皮膚和更年輕的美貌。

Reply

防下垂
防下垂 United States
10/13/2018 9:44:38 AM #

從肌膚深處開始水潤,無比舒適的濃密水感,輕柔細緻紋理 ,肌膚導向明亮的透明感。

Reply

ETUDE HOUSE 【其他】好驚炭零皮脂下巴膜 BLACK CHARCOAL CHIN PATCH的商品介紹  UrCosme (@cosme TAIWAN) 商品資訊  ETUDE HOUSE,其他,好驚炭零皮脂下巴膜 BLACK CHARCOAL CHIN PATCH        

Reply

醫學美容 Dysport 小V臉
醫學美容 Dysport 小V臉 United States
10/14/2018 9:37:36 AM #

Restylane乃一系列用於美顏的長效透明質酸產品。 Restylane療程能有效撫平皺紋、美化臉型輪廓及唇部,並可改善膚質及肌膚的彈性。Restylane透明質酸作用原理 Restylane透明質酸均以非動物來源的透明質酸作為原料,獨有的NASHA™專利技術研製而成。微量Restylane透明質酸凝膠到皮膚中,可以讓您的面部肌膚恢復豐盈飽滿。 Restylane透明質酸中的透明質酸與人體內的天然透明質酸十分相似,使用前無需進行皮膚測試,引起過敏反應的機率亦極低。

Reply

醫學美容 勞損 cosmetic.wiki
醫學美容 勞損 cosmetic.wiki United States
10/19/2018 5:55:32 AM #

初春浪漫時尚聚     Yahoo Style 風格部落客2018 SS feat.H:Connect/New Balance/理膚寶水/Sofina - 熊朵 Dodo's happiness daily - FashionGuide 華人時尚專業評鑑  Dear,friends,是不是有好久好久沒有看到熊朵的新文章了!!!OMG,  

Reply

Danika Fluetsch
Danika Fluetsch United States
1/4/2019 9:12:13 AM #

viagra 6 hours

Reply

recuva pro latest version download
recuva pro latest version download United States
3/14/2019 6:31:45 PM #

We are a group of volunteers and starting a new scheme in our community. Your web site provided us with valuable information to work on. You have done a formidable job and our whole community will be thankful to you.

Reply

fortnite pc download
fortnite pc download United States
3/15/2019 12:19:13 AM #

It’s actually a nice and useful piece of information. I’m happy that you just shared this helpful information with us. Please keep us informed like this. Thank you for sharing.

Reply

Add comment

biuquote
  • Comment
  • Preview
Loading

Rel=Me

Month List

RecentComments

Comment RSS