Wednesday, March 23, 2005
« Microsoft AntiSpyware (Beta 1) First Imp... | Main | Office Add-Ins Made Easy »

Have you ever double-clicked an XML document sitting on your local computer and have it open in Internet Explorer only to be greeted with the Information Bar?  Have you created HTML files and tried to preview them and had the same thing occur?  It gets a little frustrating, especially if you don't know why IE's doing it in the first place.  The reason IE is doing this is, more than likely, the page has or requires script to run.

With IE 6.0, Microsoft has (correctly, in my opinion) locked down security setting for the Local Machine Zone (LMZ) such that content run from the LMZ is not fully trusted (as it once was).  Attackers discovered that if they could get a file on your local machine (via exploit, convincing you to save, etc) their pages would be able to run fully trusted.  And because most users run their computers as Administrators (ack!), the saved content would have full permissions on the computer, giving the attacker a wide-open field to play in.  Now, however, rather than execute the file unrestricted, IE will pop up the Information Bar giving the user the opportunity to grant or deny permissions.

This can get a little frustrating, however, if you're developing HTML content (for documentation or to run from a CD) or XML documents and you want to test them out frequently.  As it turns out, you can tag your active documents with what's known as the Mark of the Web (MOTW) which IE will recognize and will elevate the page's permissions based on the url specified.

Basically, what it comes down to is a short HTML comment placed near the top of the document with IE willl parse.  It will extract the specified URL and compare it against the user's zone settings to grant it the proper level of permissions (i.e. Trusted, Restricted, Internet, etc).  Here's what it looks like:

<!-- saved from url=(0024)http://www.devstone.com/ -->

The 0024 is a decimal value identifying the number of characters to evaluate in reading the URL.  Alternatively you can specify the following to grant generic Internet Zone permissions to the document:

<!-- saved from url=(0014)about:internet -->

The recommended practice to to include this tag within documents that rely on scripting, frames, etc.  Recently, I have found it to be particularly beneficial in creating an HTML-based navigation system for a CD containing videos and media.  Now, users can pop in the CD/DVD and view the web pages without the annoying Information Bar popping up and ruining the experience.  Likewise, you can apply the tag to an XML document and view the document locally without the constant interruption.

Wednesday, March 23, 2005 3:57:00 AM (Mountain Standard Time, UTC-07:00)  #    Disclaimer  |  Comments [0]  |  Trackback
Comments are closed.