|
|
Posted by Ed Mullen on 12/10/06 21:15
Ed Seedhouse wrote:
> On Sat, 09 Dec 2006 15:01:03 -0500, Ed Mullen <ed@edmullen.net> wrote:
>
>> Ed Seedhouse wrote:
>
>>>> secuity risk.
>>>> IE does this. It is not off the market..
>>> I don't believe it does.
>
>> It can run an executable from both a local and remote Web page. You
>> should get a prompt to choose saving the file or running it. If you
>> choose run, it will. Try it:
>
> That's not the same thing at all. That's using the mime type of a
> downloaded file to request the o/s to load the file into it's default
> program for that mime type.
Huh? There is no "default program" to load a .exe file into. It is run
by the O/S. Did you actually try it at the link I provided and observe
what happens? MIME type has nothing to do with it. IE is looking at
the file extension which is how it is able to correctly handle files
with incorrectly served MIME types.
> But it's not going to let you run any program not associated with files
> that have a mime-type, such as, say "format.com".
Unless I'm not understanding you, you're wrong. Try it.
<http://edmullen.net/test/format.com>
No, it's not the format program, it's the same harmless file from my
last post <http://edmullen.net/test/vidtest.exe> just renamed.
> And normally the browser
> will also ask him if he wants to run or download the file.
Yep, that's what I said.
> The OP wanted to run any executable file directly and with no
> intermediary control method
Hmm, don't see that in the original post, nor do I know what you intend
by that comment.
> right from the web browser with a link.
I understand what the OP wants and I'm telling you it works here just
fine in IE6. Even IE7 will still run it locally although it doesn't
seem to run the following from an online Web page.
<a href="file:///G:/Program Files/Microsoft
Office/Office/WINWORD.EXE">Drive G:</a>
> That
> would allow any web page, anywhere, to delete all the files from your
> computer hard drive and no browser that I am aware of will do that,
> thank goodness! Even Microsoft isn't that stupid.
>
First of all, if the file is served online with the wrong MIME type IE
will still figure out that it is, for instance, a .exe file from its
file extension. It does then execute it (with prompts as I said).
If the net effect is that IE allows clicking on a link to an executable
in a Web page (local or online) and having that executable run locally,
that to me is "running". Click a link, I get asked if I want to run the
file, the file runs within my system using my O/S. Can't imagine any
other definition.
--
Ed Mullen
http://edmullen.net
http://mozilla.edmullen.net
http://abington.edmullen.net
Still, there is a calm, pure harmony, and music inside of me. - Vincent
Van Gogh
Navigation:
[Reply to this message]
|