IE & Delphi News Getting started EmbeddedWB IEAddress Url History IEFavorites APP IECache IE5Tools IESecurity UI-Less Parser HTMLEdit XML Parser IEDownload Toolbox Links

Zones & Security

IESecurityManager

 

 

If you drop the IESecurityManager component on a form with EmbeddedWB you can easily attach your own InternetSecurityManager to the webbrowser. Use EmbeddedWB's OnQueryService event and add:

//Uses urlmon, ActiveX
function
TForm1.EmbeddedWB1QueryService(const rsid, iid: TGUID;
out Obj: IUnknown): HRESULT;
begin
 if IsEqualGuid(IInternetSecurityManager, rsid) and
 IsEqualGuid(rsid, iid) then
 Result := Securitymanager1.Queryinterface(IInternetSecurityManager, Obj)
 else
 Result := E_NOINTERFACE;
end;


When the webbrowser is about to load a new page the SecurityManager is called several times:

First GetSecurityID is called to get the SecurityZone the requested URL belongs to. (All my attempts to override this function have been without success. Please mail me if you know how to do it.)

Next ProcessUrlAction is called when loading of the page might pose a security risk to the local computer. These include actions such as running a Java applet or an ActiveX control. ProcessUrlAction receives a URLACTION and you should return a corresponding URLPOLICY. See link below for a complete list of URLACTIONS and URLPOLICIES. Your OnProcessUrlAction can look like this, if you want to disable download of ActiveX controls:

function TForm1.SecurityManager1ProcessUrlAction(pwszUrl: PWideChar;dwAction: Cardinal; pPolicy: Pointer; cbPolicy: Cardinal;
pContext: Pointer; cbContext, dwFlags, dwReserved: Cardinal): HRESULT;
var
 
dwPolicy: DWORD;
begin
 
Result:=S_FALSE;
 if
(dwAction <= URLACTION_ACTIVEX_MAX) and (dwAction >=  URLACTION_ACTIVEX_MIN)
 then dwPolicy := URLPOLICY_DISALLOW else
 Result:=INET_E_DEFAULT_ACTION;
 if (Result = S_FALSE) and (cbPolicy >= SizeOf(DWORD)) then
 begin
 
Dword(ppolicy^) := dwpolicy;
  Result := S_OK;
 end;
end;


If ProcessUrlAction returns a Custom Policy (e.g. URLPOLICY_JAVA_CUSTOM) QueryCustomPolicy will get called to retrieve further information.

There seems to be a couple of limitations in the use of IInternetSecurityManager:

ProcessUrlAction is not called for all URLACTIONS. Microsoft has confirmed this to be a bug (Q239095

In must cases it is not possible to lower the security level but only to add new restrictions. 




IESecurityManager has implemented four easy-to-use UrlPolicy-properties: (ActiveX, CrossDomainData, JavaPermissions, Scripts, HTMLFormSubmit). You can easily add more.

It is recommended to read the introduction to Url Security Zones on MS' site before using the component.

LINKS:

URL Security Zones Overview

URL Security Zones Reference

Q246227 - SAMPLE- SECUMGR Overrides Security Manager for WebBrowser Host

BUG: URLACTION not Passed to Custom Security Manager


Download IESecurityManager ver. 1.0

IESecurityManager ver. 1.0 for Delphi 5


Created and maintained by
Per Lindsų Larsen

Last Update: August 19, 2000