提示用户从浏览器安装ActiveX/.Net类库
我构建了一个 .NET 类库项目，该项目在调用时（从 JavaScript）访问 mshtml.HTMLDocument。自从我将受信任站点的 .NET 配置中的权限更改为具有完全访问权限以来，我的计算机上一切正常。
但对于最终用户，我希望 Internet Explorer 能够像 Windows Update 那样提示他们。
我使用强名称和自动签名证书签署了程序集，并且断言非托管代码 SecurityPermission，但仍然没有询问用户的“黄条”。
有人知道如何触发这个提示吗？谢谢
稍后编辑：更多详细信息： 我将组件嵌入为
如果我像 ，弹出安装权限，但对象实例化失败。
更新：我将我的类设为 COM 类，实现了安全脚本编写，我用它制作了一个 MSI 并将其放入 .CAB 文件中。如果用户在受信任的根中有我的证书，它就会安装，并且它可以工作。
但是，如果它不受信任，它就不起作用（对用户没有任何疑问，只是“..已阻止来自...的以下 activex”。这是否真的意味着我必须将钱投入SSL 证书？！？
I build a .NET Class Library project that accesses the mshtml.HTMLDocument when called (from JavaScript). Everything works ok on my machine since I changed the permissions in .NET Configuration for Trusted Sites to have Full access.
But for the end users I would like Internet Explorer to prompt them just like, say, Windows Update does.
I singed the assembly with a strong name and with an auto-signed certificate, and I am asserting the Unmanaged code SecurityPermission, but still no 'yellow bar' asking the user.
Does anybody know how to trigger this prompting? Thanks
Later edit : some more details:
I am embedding the component as <object classid="dllname.dll#namespace.classname" ><object> and it works, but does not have the security permissions.
If I embed it like <object classid="clsid:..guid.." codebase="dllname.dll#-1,-1,-1,-1"></object>, the permissions to install pop-up comes up but the object fails to instantiate.
Update: I made my class a COM one, implemented Safe-for-scripting, I made a MSI out of it and put it in a .CAB file. It installs, if the user has my certificate in the Trusted Roots, and it works.
It doesn't work however if it is not trusted (no questions to the user, just '..has blocked the following activex from..'. Does that really mean I have to put my money into an SSL certificate?!?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
我假设您的问题是这样的：您能否强制 IE 提示用户安装（以前未知的）证书，以便使其他签名且安全的 ActiveX 控件能够在页面上运行？ （如果这不是您的问题，请发表评论，我可以修改。）
简短回答：否。您需要花费 $$$ 购买来自受信任机构的代码签名证书。 （据我所知，与常规 SSL 证书不同）
长答案：
从安全角度来看，使用未知证书签名与未签名类似，因为没有可信机构告诉客户端他可以相信该代码。并且IE的默认设置是不允许下载和使用未签名的ActiveX控件的。
如果您尝试做的事情被允许，那么精明的攻击者可以简单地创建一个证书，对其进行签名，从而使用户更容易运行他们的攻击代码。
当然有解决方法，但所有方法都涉及客户端采取行动更改其 IE 设置，或者（在 Intranet 设置中）让管理员推送对客户端设置的更改。
以下是来自 TechNet 的更多信息 (http://technet.microsoft.com /en-us/library/cc505863.aspx）：
I'm assuming your question is this: can you force IE to prompt the user to install a (previously unknown) certificate, in order to enable an otherwise signed and safe ActiveX control to be run on a page? (If this isn't your question, comment and I can revise.)
Short answer: no. You'll need to shell out $$$ for code-signing cert from a trusted authority. (which is, AFAIK, different from a regular SSL cert)
Long answer:
From a security perspective, being signed with an unknown certificate is similar to being unsigned, because there's no trusted authority telling the client he can trust that code. And IE's default settings are not to allow unsigned ActiveX controls to be downloaded and used.
If what you're trying to do were allowed, then a savvy attacker could simply create a cert, sign it, and thereby make it easier for users to run their attack code.
There are certainly workarounds, but all involve clients taking action to change their IE settings, or (in an intranet setting) having administrators push out changes to client settings.
Here's some more info on this from TechNet (http://technet.microsoft.com/en-us/library/cc505863.aspx):