IE6 loads local script from Internet Zone! Other browsers do not.

Forum Moderators: open

Message Too Old, No Replies

IE6 loads local script from Internet Zone! Other browsers do not.

Is this default behaviour?

penders

3:05 pm on Mar 18, 2009 (gmt 0)

To my surprise IE6 loaded a script off my local machine (file:///C:/test.js) from a page at http://www.example.com (Internet Zone, not trusted)

All other browsers (Op9, FF2, Chrome, S3) do not load the local file.

Is this default behaviour for IE6?!

Is there a security/advanced setting which controls this (although I've been through them all and can't determine which it would be)?

Thanks.

edit...
And if "C:\test.js" doesn't exist I get the strange error (in IE only):

Line: 2
Char: 1
Error: Invalid character

penders

1:55 pm on Mar 21, 2009 (gmt 0)

I have since tested this on another IE6 (Windows XP) machine (default settings) and this too will load a file off the local machine, from a page in the Inernet Zone. ie...

<!-- Works OK in IE6 --> 
<script src="file:///C:/test.js" type="text/javascript"></script>

However, IE7 (Vista) will not and gives the same error as IE6 as if the file does not exist. (This might be a restriction of Vista, as opposed to IE7, not sure.)

rocknbil

3:28 pm on Mar 21, 2009 (gmt 0)

Not ignoring this post, watching . . . however I'll comment that I do all my testing offline, and have no problem testing scripting in IE with relative paths:

within the scripts, you need to also go relative:

some_link.onmouseover=some_object.src='\.\.\/images\/some_image.jpg"

(backslashes may or may not be required, old habit . . . )

Then on upload, I change all to root relative

some_link.onmouseover=some_object.src='\/images\/some_image.jpg"

You do, however, have to do one of the following:
- Click the "warning" bar when loading the page to allow scripts to execute offline
- Put that comment hack at the top (you know the one, there's posts here about it)

It's entirely possible you have some IE setting to just disallow the scripts with no such warning?

penders

10:29 am on Mar 23, 2009 (gmt 0)

It's entirely possible you have some IE setting to just disallow the scripts with no such warning?

I don't actually have a problem per se. IE allows the script to run (which I was not expecting). All other browsers disallow the script from running (which is what I would expect - due to security).

I must say, this is not a conventional website (and in this case it may end up running within a closed network anyway where normal permissions might allow, but anyway...)

An example... A page on the internet, accessing a JavaScript file on the local machine.

index.html

<html><head><title>Test</title> 
<script type="text/javascript" src="file://C:/Test/test.js"></script> 
</head> 
<body> 
<script type="text/javascript"> 
document.write('TEST = ' + TEST); 
</script> 
</body> 
</html>

And C:\Test\test.js contains...

var TEST = 'YES - LOCAL MACHINE';

In my OP I used 3 forward slashes - this is not necessary (it works either way).

In IE6 (Windows XP) I get a page showing "YES - LOCAL MACHINE". In all other browsers I just get an undefined variable JavaScript error, since (I assume) browser security prevents a file being pulled off the local machine! IE6 (WinXP) allows this.

You do, however, have to do one of the following:
- Click the "warning" bar when loading the page to allow scripts to execute offline
- Put that comment hack at the top (you know the one, there's posts here about it)

Yes, if index.html was on the local machine I'd need to use a MOTW ('comment hack') to avoid the 'active script' warning bar. But in this case index.html is online.

rocknbil

2:36 pm on Mar 23, 2009 (gmt 0)

Yes I think that's a bug/security hole - although I'd never seen it work that way, in the src!

I used to take advantage of it with an "image preview." When someone would go to upload a photo I was able to read the file they selected in the file download box and allow it to preview on the page below the form before uploading. It was kinda cool, but a bug nonetheless.