Thursday, April 13, 2006

First Bee in my bonnet (Working with Trusted Sites..)

I have long struggled with security in Internet Explorer, having been infected a few times since my Windows 95 days by various viruses. Not to say they were all the fault of IE, but some were. Since then, I am very careful which sites I allow to run scripts or ActiveX controls on my machine.
Because I still like Internet Explorer better than Mozilla and really appreciate the "Trusted Sites" zone feature, I created a solution to all the dialog boxes required to get a new site added to the zone. It involves a small piece of script that is run from a custom context menu item I add to the standard ones. Internet Explorer allows for adding a link to an HTML page you write via a registry entry which I add with the following :


' BRIAN ONEIL
Dim fsDim sh
Set sh = CreateObject("WScript.Shell")

sh.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\ MenuExt\ Add To &Trusted Sites\","file:\\C:\Program Files\TrustedSiteContextMenu\TrustedSiteAdder.HTML"

sh.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\ MenuExt\ Add To &Trusted Sites\Flags",1,"REG_DWORD"
Set sh = Nothing
MsgBox "Registry Entries Created."


The HTML file referenced by the registry contains the following script for adding the current site you are viewing to your Trusted Sites list :


// Brian O'Neil

// alert("Adding the current page to Trusted Sites...");
var parentwin = external.menuArguments;
var doc = parentwin.document;

var urlParts = doc.URL.split("/");
var httpColon = urlParts[0].substring(0,urlParts[0].indexOf(":"));

var domain = urlParts[2];
var domainParts = domain.split(".");
var domainName = domainParts[domainParts.length-2] +
"." + domainParts[domainParts.length-1];
var prefix =
domain.substring(0,domain.indexOf(domainName)-1);

Sh = new ActiveXObject("WScript.Shell");
var key =
"HKEY_CURRENT_USER\\ Software\\Microsoft\\Windows\\ CurrentVersion\\ Internet Settings\\ ZoneMap\\ Domains\\"
key = key + domainName;
key = key + "\\" + prefix;
Sh.RegWrite(key + "\\" + httpColon, 2, "REG_DWORD");

Sh = null;
parentwin = null;
doc = null;

alert("To Undo this action, remove key "
+ key
+ " from the Registry.");
window.close();


All of the above assumes a directory called
C:\Program Files\TrustedSiteContextMenu


If anybody is interested, I have a WinZip file which decompresses all that is needed for this into the proper folders. Another caveat I forgot to mention is the browser needs to have permissions to execute script on the "Local Intranet Zone".

No comments: