Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

WebBrowser Control and the Embed Tag

I believe I am having a security problem related to using the embed tag with a WebBrowser control in my C# 2008 WinForms application.

Here is my code:

private void button2_Click(object sender, EventArgs e)
{
    webBrowser1.Navigate("C:/page1.html");
}

private void button1_Click(object sender, EventArgs e)
{
    webBrowser1.Navigate("about:blank");
    Thread.Sleep(1000);
    webBrowser1.Document.Write("<html><body><p>Hello</p><embed src='C:/test.wmv' /></body></html>");
}

This is the contents of page1.html:

<html><body><p>Hello</p><embed src='C:/test.wmv' /></body></html>

Button1 generates the word "Hello". Button2 generates the word "Hello" with an embedded movie player below it.

When I view the sources for both pages I notice they are identical, except for the name of the source file.

This leads me to believe it is something to do with my IE security settings, but I notice that I have full permissions set for embedded content. Perhaps the control doesn't recognize the source of the page as proper and therefore doesn't allow the embed tag to be used.

How can I overcome this programatically? I want to avoid writing my page to file, and navigating to that file at all cost. Any suggestions on how to trick the browser control into working properly?

1st Editor:

According to this article Webbrowser Navigate Embedded Resource this will work, but I (JT) tried and it didn't:

System.IO.Stream stream = this.GetType().Assembly.GetManifestResourceStream("WindowsFormsApplication1.Properties.test.html");
webBrowser1.DocumentStream = stream;

Odd behavior while reproducing problem:

webBrowser1.Navigate("about:blank");
do
{
Thread.Sleep(100);
} while (webBrowser1.IsBusy == true);

//Method 1. Doesn't work
string htmlString1 = File.ReadAllText("C:/page1.html");
webBrowser1.Document.Write(htmlString1);

//Method 2. Doesn't work
string htmlString2 = "<html><body><p>Hello</p><embed src='C:/test.wmv' /></body></html>";
webBrowser1.Document.Write(htmlString2);

//Method 3. DOES WORK
webBrowser1.Document.Write("<html><body><p>Hello</p><embed src='C:/test.wmv' /></body></html>");

Edit 2

Here is an example of a page created with JavaScript, with no real source file, that does display the embedded player in IE:

<html><head>
<script language="JavaScript">
function go()
{
test1 = window.open("","","menubar=0,status=0,toolbar=0");
test1.document.writeln("<html><body><p>Hello</p><embed src='test.wmv' /></body></html>");
}
</script>
</head><body><h1 onclick="go()">click</h1></body></html>

The only difference here is that IE thinks the source of the HTML is a file, although, it is created by "writeln".

While it is popular opinion that IE does not support the tag, it does, and there are many examples proving it. Attempting with IE on jsfiddle.net in IE will yeild an embedded player, while in FF it will not.

Edit 3

This issue is related to cross-domain security. Not only do the newer versions of IE refuse to allow any changes to the domain of a page once it exists, the WebBrowser control doesn't let you write text to a document that already has text in it. Only the first call to Document.Write does anything. Not only is there no apparent way to force the domain of page, there is also no way to write anything new to a page with a domain that is set because "openNew", which is required in order to do any writing, opens about:blank and defaults to a null domain that causes exceptions if set or get is attempted.

Edit 4

The issue lies in Cross-Domain security shenanigans. See THIS IE8 decided that Document.Domain can't be written to. Even if it were writable, you can apparently never communicate between protocols. So the "file://" protocol, and the "about" protocol can't communicate, or have tags pointed at one another. Here are the stumbling blocks:

  • The version of IE used by the Browser Control can't do anything to Document.Domain, not even with JavaScript.
  • You can't read the domain of about:blank.
  • You can't load a page with the proper domain, and expect to use Document.Write to write HTML into it, because you are forced to call Document.OpenNew before using Document.Write.
  • You can't modify the DocumentText by using WebBrowser.DocumentText = anything because you can only set DocumentText once per navigation. This is like some other security thing.

In conclusion, it is sufficient to say that you don't have any extra control over security with the WebBrowser control, likely even less than you have with some JavaScript generated pages (because these pages share the domain of the launch script).

Thanks for the votes/support in my endeavor, but it looks like I'm going to give up and write a page to file every time I want to change what is in the browser control. Yuck.

like image 622
Gorchestopher H Avatar asked Jun 08 '12 03:06

Gorchestopher H


People also ask

What is an embed tag?

Definition and Usage. The <embed> tag defines a container for an external resource, such as a web page, a picture, a media player, or a plug-in application.

What is WebBrowser control?

The WebBrowser control provides a managed wrapper for the WebBrowser ActiveX control. The managed wrapper lets you display Web pages in your Windows Forms client applications.

Is embed tag deprecated?

Although supported by the browsers, the <embed> is a deprecated HTML tag and is not part of the HTML4 standard.

How do I add WebBrowser control to Windows app?

To do so, right-click on the WebBrowser control, and select Properties. This action launches the Properties window. Feel free to set any properties you like. The Url property represents the web page a WebBrowser displays.


2 Answers

The issue lies in Cross-Domain security shenanigans. See THIS IE8 decided that Document.Domain can't be written to. Even if it were writable, you can apparently never communicate between protocols. So the "file://" protocol, and the "about" protocol can't communicate, or have tags pointed at one another. Here are the stumbling blocks:

  • The version of IE used by the Browser Control can't do anything to Document.Domain, not even with JavaScript.
  • You can't read the domain of about:blank.
  • You can't load a page with the proper domain, and expect to use Document.Write to write HTML into it, because you are forced to call Document.OpenNew before using Document.Write.
  • You can't modify the DocumentText by using WebBrowser.DocumentText = anything because you can only set DocumentText once per navigation. This is like some other security thing.

In conclusion, it is sufficient to say that you don't have any extra control over security with the WebBrowser control, likely even less than you have with some JavaScript generated pages (because these pages share the domain of the launch script).

Thanks for the votes/support in my endeavor, but it looks like I'm going to give up and write a page to file every time I want to change what is in the browser control. Yuck.

like image 95
Gorchestopher H Avatar answered Oct 24 '22 09:10

Gorchestopher H


@GorchestopherH thats a shame to hear the outcome. You might wish to put the 4th edit as an answer - it'd be a shame to loose the 50pts bounty altogether.

The other solution is another webbrowser control: http://code.google.com/p/geckofx/

Embeding Firefox Brower In C# Using GeckoFX

like image 1
Jeremy Thompson Avatar answered Oct 24 '22 09:10

Jeremy Thompson