From: Jerome Hauss <jhauss@...>
Date: 2004-04-30T18:22:04+09:00
Subject: Re: ActiveScriptRuby and Internet Explorer : WIN32OLE ole_methods limited?

Ah! Yes indeed, it should not be possible to load a client's file... I tried
putting my files on an HTTP server, but it is the same. I will try mailing
to Arton.

Don't you think the behaviour of WIN32OLE is peculiar inside IE ?
(having apparently an IXMLDOMNode object when calling
WIN32OLE.new("Microsoft.XMLDOM")
inside IE, whereas one gets an IXMLDOMDocument2 object when calling from the
ruby interpreter under Windows)...

Greetings,
J�r�me HAUSS

----- Original Message ----- 
From: "anon luker" <hatespyware@yahoo.com>
Newsgroups: comp.lang.ruby
To: "ruby-talk ML" <ruby-talk@ruby-lang.org>
Sent: Thursday, April 29, 2004 11:59 PM
Subject: Re: ActiveScriptRuby and Internet Explorer : WIN32OLE ole_methods
limited?


> "Jerome Hauss" <jhauss@gfi.fr> wrote in message
> news:<174801c42de4$454d6530$032f10ac@WJHAUSS2>...
>
> > Sorry for the lack of information, and thank you for your test.
>
> Sorry for being so curt, but had you not posted more information I
> wouldn't have guessed that you wanted to use your script _inside_ of ie
> - I thought you merely wanted to use the parser tools bundled with it.
>
> <snip>
>
> > - load : there's the following error Erreur : load OLE
> > rb_compile_error:80070005 in msxml3.dll Acc�s refus�
> >
> > (translation : ...access refused ... an exception has occurred)
> ______________
> From the ASR website:
> 12 Jun. 2000, 03:05:32 JST
> 12 Jun. 2000, RScript Version 1.0.3.2
> Now ActiveScriptRuby support Internet Explorer's Security Option.
> Ruby's dangerous operations are now ristricted in IE.
> ______________
>
> Your code is perfect, as far as I can tell. Your difficulty is related
> to the fact that you're doing something ASR deems unsafe. For details
> on what precisely deliniates safe vs. unsafe, I'll have to refer you
> to Artonx. Clearly, allowing load to work in client-side scripts would
> allow malicious webpages trivial read-access to the client's files.
> Bypassing security will probably require modifying the engine, too - I
> haven't seen any documentation on security configuration. Again, you'll
> have to get with Arton.
>
> -cheers
>