.htc 文件（如 CSS3Pie 或 border-radius.htc）是 active-x 控件吗？
我正在尝试找到一种快速（如果需要的话甚至是肮脏的）解决方案来为我的公司的客户空间实现圆角。
安全和 IT 团队告诉我，border-radius.htc (http://code.google.com/p/curved-corner/downloads/detail?name=border-radius.htc) 甚至 CSS3Pie 都是 active-x 组件。
因此，他们构成了安全威胁，所以他们不会实施这一点。
.htc 文件是 activex 组件吗？
谢谢！
I'm trying to find a quick (even dirty if needed) solution to implement rounded corners into a client space for my company.
Security and IT team tells me that border-radius.htc (http://code.google.com/p/curved-corner/downloads/detail?name=border-radius.htc) or even CSS3Pie are active-x components.
And so, they pose a security threat, so thet won't implement this.
Are .htc-files activex components?
Thanks!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
HTC 行为不是 ActiveX 组件，不会带来安全风险。 (*)
常见的混淆源于这样一个事实：IE 专有的“行为”CSS 属性可以引用两种种实现：二进制实现（其中有几个内置于 IE 和其他自定义实现）可以通过
虽然前者在技术上仍然不是 ActiveX，但它确实允许在用户计算机上运行任意二进制代码，这肯定会被视为安全风险。因此，这种类型的行为实际上从未在互联网上使用。
另一方面，HTC 行为本质上只是 HTML+JavaScript，因此受到所有相同的沙箱和安全预防措施的约束，就像您只是通过
如果这个解释对您的安全/IT 团队来说仍然不够有说服力，并且您想专门使用 CSS3 PIE，那么可以使用 plain-JS 版本的库，您可以使用它来代替 HTC 文件，这应该可以避免他们可能有的任何担心。然而，该方法有一些缺点，如该页面所列。
我希望这有帮助。
(*) 我不是安全专家。 ;)
HTC behaviors are not ActiveX components and do not pose a security risk. (*)
The common confusion stems from the fact that IE's proprietary 'behavior' CSS property can reference two kinds of implementations: binary implementations (of which there are several built-in to IE and other custom ones can be loaded via the
<object>tag), and hypertext implementations (aka HTC files, e.g. CSS3 PIE).While the former is still not technically ActiveX, it does allow arbitrary binary code to be run on the user's machine which could certainly be considered a security risk. As a result, this type of behavior is practically never used on the internet.
HTC behaviors, on the other hand, are essentially just HTML+JavaScript and therefore are subject to all the same sandboxing and security precautions as if you just included JS into your page via a
<script>tag. In fact it is even more locked-down, as IE does not even allow HTC files to be loaded cross-domain (much to my frustration).If this explanation is still not convincing enough for your Security/IT team, and if you're wanting to use CSS3 PIE specifically, there is a plain-JS version of the library which you can use instead of the HTC file which should avoid any fears they may have. However there are some downsides to that approach as listed on that page.
I hope that helps.
(*) I am not a security expert. ;)