Click here to Skip to main content
Click here to Skip to main content

Avoiding ActiveX Activation in IE

, 15 Jun 2006 CPOL
Rate this:
Please Sign up or sign in to vote.
An updated version of the AutoActivateControl class posted by Dundas Software.

Introduction

As a result of the Eolas patent, Microsoft has changed the way that Internet Explorer loads ActiveX controls. All interactive controls which are embedded directly within a page must now be activated before they can be used.

ActiveX activation in Internet Explorer

An article on MSDN[^] provides instructions on a workaround for this change. The work-around involves creating an external script file for every control instance, which may not be practical in a dynamic site.

Terrence Sheflin, of Dundas Software, recently posted an article[^] and a control which attempts to make the workaround more reusable. However, the control has several problems:

The control creates a new JavaScript file for every instance created:

  • With multiple instances on a page, only the last control is rendered.
  • With multiple requests, data from one request may be overwritten with data from another request. If the control contains sensitive information, this could result in security problems.
  • The security settings on the web server must be modified to allow ASP.NET to create files in the root folder of the application.

The control modifies the page flow:

For example, if the control is applied to TargetControl, a page containing:

<form runat="server">
    <h1>Page Heading</h1>

    <div class="container">
        <xyz:someControl id="TargetControl" runat="server" ... />
    </div>
</form>

will actually be rendered as:

<form runat="server">
    <script src="/embed.js"></script>  <-- This line renders TargetControl

    <h1>Page Heading</h1>
    <div class="container">
        
    </div>
</form>

The control cannot be used declaratively:

The control does not expose a parameter-less constructor, so it cannot be used declaratively. Instead, the code in the Page_Load method must locate the target control and create an instance of the AutoActivateControl to wrap it. If the target control is within a templated parent such as a Repeater, this involves a call to FindControl for each instance of the template created.

Other issues:

  • If script is disabled, nothing will be displayed.
  • HTML OBJECT tags cannot be used unless that have the runat="server" attribute added.
  • The rendered JavaScript output is not properly escaped - only the carriage return and line-feed characters are replaced.
  • The control does not use the correct HtmlTextWriter type for the current browser.
  • The control affects all browsers, not just Internet Explorer.

A better way...

Internet Explorer doesn't actually need a unique external JavaScript file for every control instance. Instead, you can create a single external JavaScript file with a single method:

window.AutoActivateControl_WriteObjectElement = 
                         function(elementData) 
{
    if ("string" != typeof(elementData) || 0 == elementData.length) return;
    document.write(elementData);
};

You can then call this method from script within the page, and the control will be rendered without activation.

The original control uses the PreRender event to capture the output of the target control, and the RegisterClientScriptBlock method to include the output in the page. As a result, the control is rendered immediately after the opening <form runat="server"> tag, which is outside of the normal page flow.

The solution is to create a container control which will contain all of the controls to be modified. It can then use the RenderChildren method to capture the output and override the Render method to render the output in the correct location. With this solution, even static HTML can be targeted, so <OBJECT> tags no longer require the runat="server" attribute.

The new control is designed to be used declaratively, and can be used anywhere on the page. It will only affect browsers which support ActiveX controls (as detected by the HttpBrowserCapabilities class), and will render a <noscript> tag for situations when script is disabled.

Using the control

  1. Compile the control using one of the provided files:
    • build_VS2003.bat for .NET 1.1;
    • build_VS2005.bat for .NET 2.0;
    • AutoActivateControl_VS2005.csproj for Visual Studio 2005;
  2. Add the assembly to your bin folder;
  3. [.NET 1.1] Copy the JavaScript file to the root of your application;
  4. Register the tag prefix for the control:
    <%@ Register
        TagPrefix="tri"
        Namespace="Trinet.Web.Utilities"
        Assembly="Trinet.Web.Utilities.AutoActivateControl"
    %>
  5. Add the control as a parent of any control you want to target:
    <tri:autoActivateControl runat="server">
        <xyz:someControl id="TargetControl" runat="server" ... />
        <object classid="clsid: ... />
    </tri:autoActivateControl>

In .NET 2.0, the script will be loaded from an embedded resource, so it is not necessary to distribute the JavaScript file. If you want to override this behavior, you can set the UseScriptResource to false.

If you want to move the JavaScript file to a different location, you will need to set the ScriptLocation property to the new path:

<tri:autoActivateControl runat="server" 
      scriptLocation="~/scripts/AutoActivateControl.js">

An alternative solution

As Mark Werner and FunkyMonkey have pointed out, it is also possible to avoid control activation by modifying the HTML DOM from an external script file [^] once the page has loaded. This method works with all pages, not just ASP.NET, and only requires a single line addition to each page.

History

  • 1 June 2006 - Initial version.
  • 6 June 2006:
    • Fixed a typo in the TagPrefix attribute in the AssemblyInfo.cs file;
    • Fixed a typo in the Assembly attribute of the <%@ Register ... directive;
    • Added a link to an alternative solution;

License

This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Share

About the Author

Richard Deeming
Software Developer Nevalee Business Solutions
United Kingdom United Kingdom
No Biography provided
Follow on   Twitter   Google+

Comments and Discussions

 
GeneralMy vote of 5 Pinmembermanoj kumar choubey15-Mar-12 21:53 
GeneralNot compatible with caching Pinmemberbinhex16-Jan-07 7:58 
GeneralRe: Not compatible with caching Pinmemberbinhex16-Jan-07 8:08 
GeneralRe: Not compatible with caching PinmemberRichard Deeming17-Jan-07 10:04 
GeneralAutoActivateControl Pinmembersporty8121-Nov-06 16:02 
GeneralWeb User Control Pinmemberhallie8-Nov-06 23:29 
GeneralRe: Web User Control PinmemberRichard Deeming9-Nov-06 0:58 
GeneralDual version class PinmemberAshley van Gerven26-Aug-06 0:41 
GeneralAssembly not found PinmemberToniTonino6-Jun-06 5:36 
AnswerRe: Assembly not found PinmemberRichard Deeming6-Jun-06 6:33 
General.DLL Pinmemberccalzaretta16-Jun-06 3:41 
GeneralRe: .DLL PinmemberVasudevan Deepak Kumar3-Sep-07 6:21 
GeneralAnother simple fix to download PinmemberFunkyMonkey5-Jun-06 16:59 
GeneralRe: Another simple fix to download PinmemberFunkyMonkey1-Jul-06 7:17 
General'include' this at the end of files... PinmemberMark Werner2-Jun-06 7:02 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.

| Advertise | Privacy | Terms of Use | Mobile
Web01 | 2.8.141216.1 | Last Updated 15 Jun 2006
Article Copyright 2006 by Richard Deeming
Everything else Copyright © CodeProject, 1999-2014
Layout: fixed | fluid