I believe I am having a security problem related to using the embed tag with a WebBrowser control in my C# 2008 WinForms application.
Here is my code:
private void button2_Click(object sender, EventArgs e)
{
webBrowser1.Navigate("C:/page1.html");
}
private void button1_Click(object sender, EventArgs e)
{
webBrowser1.Navigate("about:blank");
Thread.Sleep(1000);
webBrowser1.Document.Write("<html><body><p>Hello</p><embed src='C:/test.wmv' /></body></html>");
}
This is the contents of page1.html:
<html><body><p>Hello</p><embed src='C:/test.wmv' /></body></html>
Button1 generates the word “Hello”.
Button2 generates the word “Hello” with an embedded movie player below it.
When I view the sources for both pages I notice they are identical, except for the name of the source file.
This leads me to believe it is something to do with my IE security settings, but I notice that I have full permissions set for embedded content. Perhaps the control doesn’t recognize the source of the page as proper and therefore doesn’t allow the embed tag to be used.
How can I overcome this programatically? I want to avoid writing my page to file, and navigating to that file at all cost. Any suggestions on how to trick the browser control into working properly?
1st Editor:
According to this article Webbrowser Navigate Embedded Resource this will work, but I (JT) tried and it didn’t:
System.IO.Stream stream = this.GetType().Assembly.GetManifestResourceStream("WindowsFormsApplication1.Properties.test.html");
webBrowser1.DocumentStream = stream;
Odd behavior while reproducing problem:
webBrowser1.Navigate("about:blank");
do
{
Thread.Sleep(100);
} while (webBrowser1.IsBusy == true);
//Method 1. Doesn't work
string htmlString1 = File.ReadAllText("C:/page1.html");
webBrowser1.Document.Write(htmlString1);
//Method 2. Doesn't work
string htmlString2 = "<html><body><p>Hello</p><embed src='C:/test.wmv' /></body></html>";
webBrowser1.Document.Write(htmlString2);
//Method 3. DOES WORK
webBrowser1.Document.Write("<html><body><p>Hello</p><embed src='C:/test.wmv' /></body></html>");
Edit 2
Here is an example of a page created with JavaScript, with no real source file, that does display the embedded player in IE:
<html><head>
<script language="JavaScript">
function go()
{
test1 = window.open("","","menubar=0,status=0,toolbar=0");
test1.document.writeln("<html><body><p>Hello</p><embed src='test.wmv' /></body></html>");
}
</script>
</head><body><h1 onclick="go()">click</h1></body></html>
The only difference here is that IE thinks the source of the HTML is a file, although, it is created by “writeln”.
While it is popular opinion that IE does not support the tag, it does, and there are many examples proving it. Attempting with IE on jsfiddle.net in IE will yeild an embedded player, while in FF it will not.
Edit 3
This issue is related to cross-domain security. Not only do the newer versions of IE refuse to allow any changes to the domain of a page once it exists, the WebBrowser control doesn’t let you write text to a document that already has text in it. Only the first call to Document.Write does anything. Not only is there no apparent way to force the domain of page, there is also no way to write anything new to a page with a domain that is set because “openNew”, which is required in order to do any writing, opens about:blank and defaults to a null domain that causes exceptions if set or get is attempted.
Edit 4
The issue lies in Cross-Domain security shenanigans. See THIS IE8 decided that Document.Domain can’t be written to. Even if it were writable, you can apparently never communicate between protocols. So the “file://” protocol, and the “about” protocol can’t communicate, or have tags pointed at one another. Here are the stumbling blocks:
- The version of IE used by the Browser Control can’t do anything to
Document.Domain, not even with JavaScript. - You can’t read the domain of about:blank.
- You can’t load a page with the proper domain, and expect to use
Document.Write to write HTML into it, because you are forced to call
Document.OpenNew before using Document.Write. - You can’t modify the DocumentText by using WebBrowser.DocumentText =
anything because you can only set DocumentText once per navigation. This is like some other security thing.
In conclusion, it is sufficient to say that you don’t have any extra control over security with the WebBrowser control, likely even less than you have with some JavaScript generated pages (because these pages share the domain of the launch script).
Thanks for the votes/support in my endeavor, but it looks like I’m going to give up and write a page to file every time I want to change what is in the browser control. Yuck.
The issue lies in Cross-Domain security shenanigans. See THIS IE8 decided that Document.Domain can’t be written to. Even if it were writable, you can apparently never communicate between protocols. So the “file://” protocol, and the “about” protocol can’t communicate, or have tags pointed at one another. Here are the stumbling blocks:
Document.Domain, not even with JavaScript.
Document.Write to write HTML into it, because you are forced to call
Document.OpenNew before using Document.Write.
anything because you can only set DocumentText once per navigation. This is like some other security thing.
In conclusion, it is sufficient to say that you don’t have any extra control over security with the WebBrowser control, likely even less than you have with some JavaScript generated pages (because these pages share the domain of the launch script).
Thanks for the votes/support in my endeavor, but it looks like I’m going to give up and write a page to file every time I want to change what is in the browser control. Yuck.