ActiveX Code Signing | Microsoft Windows Architecture for Developers Training Kit

ActiveX Code Marking

There are two ways to guarantee your users that the control on your Web page is safe. You can ensure that the control is safe to initialize, and also that it is safe to be used in the script on the Web page.

Safe for Initializing

Controls that can be initialized with values in HTML <PARAM> tags must be marked as safe for initializing before Microsoft Internet Explorer will read the <PARAM> tags.

When Microsoft Internet Explorer encounters initialization tags for a control on a Web page, it queries the control to determine whether it is safe to be initialized. The result of this query, combined with the safety level set by the user , determines whether the control is initialized or not.

Safe for Scripting

An object model is a hierarchy of objects that gives structure to an object-based program. By defining the relationships between objects that are part of the program, an object model simplifies programming. When you mark a control as safe for scripting, you guarantee that the object model of the control will not cause a safety problem, either in the form of data corruption or security leaks.

Marking a control as safe for scripting ensures that the script can not use any properties or methods that could damage the user's computer. For example, a control that allows information to be written to the hard disk should not be marked as safe for scripting.

Scripting is the process of entering script code such as VBScript or JScript to be executed on a Web server or Web browser. When Microsoft Internet Explorer encounters a control on a Web page, it queries the control to determine whether it is safe for scripting. The result of this query, combined with the safety level set by the user, determines whether the control is available to be scripted.

* To mark a control as safe for scripting in Visual Basic:

Start the Visual Basic Application Setup Wizard .
Create an Internet Download Setup program for your control.
When the Internet Package dialog appears, click the Safety button.
On the Safety dialog box, select Safe For Scripting and click OK .
Complete the rest of the Setup Wizard steps, then click Finish to build the control setup program.

Setting the Safety Level

As with signed controls, the Custom Security Level allows you to specify how Internet Explorer works with a control.

Option	Description
Enable	Run it automatically.
Prompt	Prompt the user before running.
Disable	Do not run.