Securely hosting a webbrowser control in a managed code environment

• US 20070199051A1
• Filed: 02/15/2006
• Published: 08/23/2007
• Est. Priority Date: 02/15/2006
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Wang, Hua, Alcazar, Mark, Vellanki, Kusuma, Lavoie, Lauren, Parikh, Sujal, Corby, Karen
• Granted Patent: US 7,664,865 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G09G 2358/00 Arrangements for display data security

Abstract

Described is a technology by which a managed web browser control hosts an unmanaged web OLE control to control navigation requests by the unmanaged web OLE control on behalf of partially trusted code. Site locking may be performed to constrain a site to navigation only to other pages within its site, thereby preventing navigation to an undesirable location. In one example, the unmanaged web OLE control communicates information corresponding to a navigation request to the managed web browser control, and the managed web browser control processes the information to establish whether the navigation is to be allowed or blocked. The benefits of site-locking with respect to privacy are also described, as is z-order management to protect against site spoofing.

Claims

1. A computer-readable medium having computer-executable instructions, which when executed perform steps, comprising:

receiving a request from a component to navigate to a site; and

locking the navigation to a set of web pages based on a current site.

2. The computer-readable medium of claim 1 wherein locking the navigation includes receiving an event corresponding to navigation to a site.

3. The computer-readable medium of claim 2 wherein locking the navigation includes processing data associated with the event to determine if a site identifier corresponds to the current site.

4. The computer-readable medium of claim 3 wherein processing the data associated with the event comprises requesting creation of an object based on the site identifier.

5. The computer-readable medium of claim 4 wherein locking the navigation to the set of web pages comprises allowing the navigation to proceed if the object is successfully created, and blocking the navigation if the object is not successfully created.

6. The computer-readable medium of claim 1 wherein locking the navigation to the set of web pages comprises inserting a page to create a condition that causes zone checking.

7. In a computing environment, a system comprising:

a managed web browser control;

an unmanaged web OLE control hosted by the managed web browser control, including an interface for receiving a navigation request from a partially trusted program; and

the unmanaged web OLE control communicating information corresponding to the navigation request to the managed web browser control, and the managed web browser control processing the information to establish whether the navigation is to be allowed or blocked.

8. The system of claim 7 wherein the information corresponding to the navigation request is provided as an event to the managed web browser control, and wherein the managed web browser control is associated with an event handler that handles the event from the unmanaged web OLE control.

9. The system of claim 7 wherein the managed web browser control further includes means for requesting creation of an object corresponding to the information.

10. The system of claim 9 wherein the information by which the object creation is requested corresponds to a site identifier.

11. The system of claim 9 wherein the means for requesting creation of an object corresponding to the information comprises means for requesting creation of the object via a .NET framework.

12. The system of claim 7 further comprising means for managing the z-order of rendered content such that the managed browser control is higher in z-order than any popup.

13. In a managed computing environment, a method comprising:

hosting an unmanaged web OLE control in a managed web browser control; and

controlling a navigation requested by the unmanaged web OLE control to prevent navigation to an undesirable location.

14. The method of claim 13 wherein controlling the navigation requested by the unmanaged web OLE control comprises handling an event received from the unmanaged web OLE control, the event corresponding to a requested navigation to a location.

15. The method of claim 14 wherein handling the event comprises providing first data corresponding to a current location and second data corresponding to a requested location along with an object creation request to a mechanism that creates an object only when the current and requested locations sufficiently correspond.

16. The method of claim 15 wherein the locations sufficiently correspond and an object is created when the current location is within the same site as the requested location.

17. The method of claim 13 wherein controlling the navigation comprises site locking by which a site'"'"'s request to navigate to another site is blocked.

18. The computer-readable medium of claim 13 wherein controlling the navigation comprises inserting a page to create a condition that causes zone checking.