VB：获取已编译的DLL的调用应用程序信息；通讯安全
通过 COM，人们可以获得对目标系统的绝对控制。例如：在 IE 中使用 javascript 的 ActiveXObject 对象，可以创建某些旨在直接访问系统属性和文件或与系统属性和文件交互的对象。人们可能会认为，常识表明用户在安装浏览器后立即禁用 IE 中的 ActiveX 功能，以确保他们的系统在上网时受到保护，或者至少密切关注他们允许哪些网站。但是，我怀疑许多普通 PC 用户是否知道如何或为何这样做，或者只是随着时间的推移厌倦了微观管理。我认为我的 COM 类所服务的任何 PC 用户或管理员都会非常感激不必处理这个问题。值得庆幸的是，现在 IE 版本似乎默认禁用了 ActiveX。
我用 VB 构建了一个非常通用的 COM 类库。我并不打算从任何网站调用它，但该功能只是 COM 平台的一部分。我想阻止从 IE 调用该库，除非该网站位于白名单域中，以主动保护用户（最终是他们的整个 Intranet）免受恶意网站的伤害。 VB.Net 中最好的方法是什么来判断哪个应用程序调用了我的 DLL，以便能够判断它是否是从来自 IE 的任何命令或进程调用的？还有，我的 dll 是哪个域？
编辑：我相信这可能是重复的。请参阅：调用程序集以获取应用程序名称 VB.NET
< code>System.Environment.GetCommandLineArgs()(0) 获取调用应用程序路径。有了这些信息，我可以将其与应用程序的黑/白名单进行比较。问题暂时解决了。
Through COM, one can potentially gain absolute control over a target system. For example: using javascript's ActiveXObject object in IE, one can create certain objects which were designed to have direct access or interaction with system properties and files. One would think common sense dictates users disable ActiveX features in IE immediately after installing the browser to ensure their system is protected while surfing the net, or at least paying close attention to which websites they permit. But, I doubt many average PC users know how or why to do this, or just get tired of mirco-managing it over time. I think any PC user or admin my COM class caters to would greatly appreciate not having to deal with that. Thankfully it looks like IE versions come packaged with ActiveX disabled by default nowadays.
I've built a very versatile COM class library in VB. I didn't intend for it to be callable from any website, but that feature is just part of the COM platform. I'd like to prevent the library from being called from IE unless the website is on a white-listed domain to proactively protect the user (and ultimately their entire intranet) from harm from malicious websites. What would be the best method in VB.Net to tell which application called my DLL, to be able to tell if it was called from any command or process originating from IE? And, what domain called my dll?
Edit: I believe this might be a duplicate. See: Calling Assembly to get Application Name VB.NET
System.Environment.GetCommandLineArgs()(0) gets me the calling application path. With this info, I can compare it to a black/white-list of applications. Problem solved for now.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
不要将控件标记为“脚本安全”。
默认安全设置不允许编写此类控件的脚本。
Don't mark the control as Safe for Scripting.
Default security settings will not allow such controls to be scripted.
我想，自我回答，可能是重复的。请参阅 调用程序集来获取应用程序名称 VB.NET
在这种情况下，该类从未被标记为安全的脚本编写，并且其意图已经是永远不会将其标记为安全。问题是如何获取调用应用程序信息，以便我可以添加额外的安全措施，以防调用应用程序所拥有的安全措施不够。
Self-answer, and possibly duplicate, I suppose. See
System.Environment.GetCommandLineArgs()(0)from Calling Assembly to get Application Name VB.NETIn this case, the class never was marked as safe for scripting and the intent was already never to mark it safe. The issue was how to obtain the calling application info so I could add additional security measures in case those which the calling application had were not enough.