WebBrowser控件和嵌入标签

Question

I believe I am having a security problem related to using the embed tag with a WebBrowser control in my C# 2008 WinForms application. 我相信我遇到了与在我的C＃2008 WinForms应用程序中使用带有WebBrowser控件的embed标签相关的安全问题。

Here is my code: 这是我的代码：

private void button2_Click(object sender, EventArgs e)
{
    webBrowser1.Navigate("C:/page1.html");
}

private void button1_Click(object sender, EventArgs e)
{
    webBrowser1.Navigate("about:blank");
    Thread.Sleep(1000);
    webBrowser1.Document.Write("<html><body><p>Hello</p><embed src='C:/test.wmv' /></body></html>");
}

This is the contents of page1.html: 这是page1.html的内容：

<html><body><p>Hello</p><embed src='C:/test.wmv' /></body></html>

Button1 generates the word "Hello". Button1生成单词“Hello”。 Button2 generates the word "Hello" with an embedded movie player below it. Button2生成单词“Hello”，其下方嵌入了一个电影播放器。

When I view the sources for both pages I notice they are identical, except for the name of the source file. 当我查看两个页面的源时，我注意到它们是相同的，除了源文件的名称。

This leads me to believe it is something to do with my IE security settings, but I notice that I have full permissions set for embedded content. 这让我相信它与我的IE安全设置有关，但我注意到我为嵌入式内容设置了完整的权限。 Perhaps the control doesn't recognize the source of the page as proper and therefore doesn't allow the embed tag to be used. 也许控件不能正确识别页面的来源，因此不允许使用嵌入标签。

How can I overcome this programatically? 我怎样才能以编程方式克服这个问题？ I want to avoid writing my page to file, and navigating to that file at all cost. 我想避免将我的页面写入文件，并不惜一切代价导航到该文件。 Any suggestions on how to trick the browser control into working properly? 有关如何欺骗浏览器控件正常工作的任何建议？

1st Editor: 第一编辑：

According to this article Webbrowser Navigate Embedded Resource this will work, but I (JT) tried and it didn't: 根据这篇文章Webbrowser Navigate Embedded Resource这将有效，但是我（JT）尝试了它并没有：

System.IO.Stream stream = this.GetType().Assembly.GetManifestResourceStream("WindowsFormsApplication1.Properties.test.html");
webBrowser1.DocumentStream = stream;

Odd behavior while reproducing problem: 再现问题时的奇怪行为：

webBrowser1.Navigate("about:blank");
do
{
Thread.Sleep(100);
} while (webBrowser1.IsBusy == true);

//Method 1. Doesn't work
string htmlString1 = File.ReadAllText("C:/page1.html");
webBrowser1.Document.Write(htmlString1);

//Method 2. Doesn't work
string htmlString2 = "<html><body><p>Hello</p><embed src='C:/test.wmv' /></body></html>";
webBrowser1.Document.Write(htmlString2);

//Method 3. DOES WORK
webBrowser1.Document.Write("<html><body><p>Hello</p><embed src='C:/test.wmv' /></body></html>");

Edit 2 编辑2

Here is an example of a page created with JavaScript, with no real source file, that does display the embedded player in IE: 以下是使用JavaScript创建的页面示例，没有真正的源文件，它在IE中显示嵌入式播放器：

<html><head>
<script language="JavaScript">
function go()
{
test1 = window.open("","","menubar=0,status=0,toolbar=0");
test1.document.writeln("<html><body><p>Hello</p><embed src='test.wmv' /></body></html>");
}
</script>
</head><body><h1 onclick="go()">click</h1></body></html>

The only difference here is that IE thinks the source of the HTML is a file, although, it is created by "writeln". 这里唯一的区别是IE认为HTML的来源是一个文件，尽管它是由“writeln”创建的。

While it is popular opinion that IE does not support the tag, it does, and there are many examples proving it. 虽然人们普遍认为IE不支持标签，但确实如此，并且有很多例子可以证明它。 Attempting with IE on jsfiddle.net in IE will yeild an embedded player, while in FF it will not . 在IE的jsfiddle.net上尝试使用IE会产生嵌入式播放器，而在FF中却不会 。

Edit 3 编辑3

This issue is related to cross-domain security. 此问题与跨域安全性有关。 Not only do the newer versions of IE refuse to allow any changes to the domain of a page once it exists, the WebBrowser control doesn't let you write text to a document that already has text in it. 不仅较新版本的IE拒绝允许对页面域进行任何更改，WebBrowser控件不允许您将文本写入已包含文本的文档。 Only the first call to Document.Write does anything. 只有第一次调用Document.Write才能做任何事情。 Not only is there no apparent way to force the domain of page, there is also no way to write anything new to a page with a domain that is set because "openNew", which is required in order to do any writing, opens about:blank and defaults to a null domain that causes exceptions if set or get is attempted. 不仅没有明显的方法来强制页面域，也没有办法用设置域的页面写任何新内容，因为“openNew”是执行任何写入所必需的，打开：空白并默认为空域，如果尝试设置或获取，则会导致异常。

Edit 4 编辑4

The issue lies in Cross-Domain security shenanigans. 问题在于跨域安全诡计。 See THIS IE8 decided that Document.Domain can't be written to. 请参阅此 IE8决定无法写入Document.Domain。 Even if it were writable, you can apparently never communicate between protocols. 即使它是可写的，你显然也不会在协议之间进行通信。 So the "file://" protocol, and the "about" protocol can't communicate, or have tags pointed at one another. 因此，“file：//”协议和“about”协议无法通信，或者标签彼此指向。 Here are the stumbling blocks: 以下是绊脚石：

The version of IE used by the Browser Control can't do anything to Document.Domain, not even with JavaScript. 浏览器控件使用的IE版本无法对Document.Domain执行任何操作，甚至不能使用JavaScript。
You can't read the domain of about:blank. 你无法阅读about：blank的域名。
You can't load a page with the proper domain, and expect to use Document.Write to write HTML into it, because you are forced to call Document.OpenNew before using Document.Write. 您无法使用正确的域加载页面，并期望使用Document.Write将HTML写入其中，因为在使用Document.Write之前，您必须调用Document.OpenNew。
You can't modify the DocumentText by using WebBrowser.DocumentText = anything because you can only set DocumentText once per navigation. 你不能使用WebBrowser.DocumentText = 任何东西 ，因为你只能设置DocumentText每一次航行修改DocumentText。 This is like some other security thing . 这就像其他一些安全事情。

In conclusion, it is sufficient to say that you don't have any extra control over security with the WebBrowser control, likely even less than you have with some JavaScript generated pages (because these pages share the domain of the launch script). 总而言之，您可以使用WebBrowser控件对安全性没有任何额外的控制，甚至可能比使用一些JavaScript生成的页面更少（因为这些页面共享启动脚本的域）。

Thanks for the votes/support in my endeavor, but it looks like I'm going to give up and write a page to file every time I want to change what is in the browser control. 感谢我的努力中的投票/支持，但看起来我每次想要更改浏览器控件中的内容时都会放弃并编写一个页面来存档。 Yuck. 呸。

Answer 1

The issue lies in Cross-Domain security shenanigans. 问题在于跨域安全诡计。 See THIS IE8 decided that Document.Domain can't be written to. 请参阅此 IE8决定无法写入Document.Domain。 Even if it were writable, you can apparently never communicate between protocols. 即使它是可写的，你显然也不会在协议之间进行通信。 So the "file://" protocol, and the "about" protocol can't communicate, or have tags pointed at one another. 因此，“file：//”协议和“about”协议无法通信，或者标签彼此指向。 Here are the stumbling blocks: 以下是绊脚石：

The version of IE used by the Browser Control can't do anything to Document.Domain, not even with JavaScript. 浏览器控件使用的IE版本无法对Document.Domain执行任何操作，甚至不能使用JavaScript。
You can't read the domain of about:blank. 你无法阅读about：blank的域名。
You can't load a page with the proper domain, and expect to use Document.Write to write HTML into it, because you are forced to call Document.OpenNew before using Document.Write. 您无法使用正确的域加载页面，并期望使用Document.Write将HTML写入其中，因为在使用Document.Write之前，您必须调用Document.OpenNew。
You can't modify the DocumentText by using WebBrowser.DocumentText = anything because you can only set DocumentText once per navigation. 你不能使用WebBrowser.DocumentText = 任何东西 ，因为你只能设置DocumentText每一次航行修改DocumentText。 This is like some other security thing . 这就像其他一些安全事情。

In conclusion, it is sufficient to say that you don't have any extra control over security with the WebBrowser control, likely even less than you have with some JavaScript generated pages (because these pages share the domain of the launch script). 总而言之，您可以使用WebBrowser控件对安全性没有任何额外的控制，甚至可能比使用一些JavaScript生成的页面更少（因为这些页面共享启动脚本的域）。

Thanks for the votes/support in my endeavor, but it looks like I'm going to give up and write a page to file every time I want to change what is in the browser control. 感谢我的努力中的投票/支持，但看起来我每次想要更改浏览器控件中的内容时都会放弃并编写一个页面来存档。 Yuck. 呸。

Answer 2

This is why: 这就是为什么：

http://msdn.microsoft.com/en-us/library/windows/desktop/dd562847(v=vs.85).aspx http://msdn.microsoft.com/en-us/library/windows/desktop/dd562847(v=vs.85).aspx

The preceeding examples work in Firefox but not in Internet Explorer. 前面的示例适用于Firefox，但不适用于Internet Explorer。 To embed the Player control in a webpage that can be displayed by Internet Explorer, you must create an OBJECT element that has a classid attribute set to the class ID of the Windows Media Player control. 若要将Player控件嵌入可由Internet Explorer显示的网页中，必须创建一个OBID元素，该元素的classid属性设置为Windows Media Player控件的类ID。 The following example shows how to embed the Windows Media Player control in a webpage that can be displayed correctly by both Internet Explorer and Firefox. 以下示例说明如何将Windows Media Player控件嵌入到可由Internet Explorer和Firefox正确显示的网页中。 Script on the page detects the browser type and generates the appropriate OBJECT tag. 页面上的脚本检测浏览器类型并生成相应的OBJECT标记。

For your convenience here it is: 为了您的方便，这里是：

private void button3_Click(object sender, EventArgs e)
{
    webBrowser1.Navigate("about:blank");
    do
    {
        Thread.Sleep(100);
    } while (webBrowser1.IsBusy == true);

    string htmlString1 = File.ReadAllText("C:/test.html");
    webBrowser1.Document.Write(htmlString1);
    return;
}

Contents of Test.html: Test.html的内容：

<OBJECT id="VIDEO" width="320" height="240" 
    style="position:absolute; left:0;top:0;"
    CLASSID="CLSID:6BF52A52-394A-11d3-B153-00C04F79FAA6"
    type="application/x-oleobject">

    <PARAM NAME="URL" VALUE="c:\test.wmv">
    <PARAM NAME="SendPlayStateChangeEvents" VALUE="True">
    <PARAM NAME="AutoStart" VALUE="True">
    <PARAM name="uiMode" value="none">
    <PARAM name="PlayCount" value="9999">
</OBJECT>

Answer 3

@GorchestopherH thats a shame to hear the outcome. @GorchestopherH听到结果很遗憾。 You might wish to put the 4th edit as an answer - it'd be a shame to loose the 50pts bounty altogether. 你可能希望将第4次编辑作为答案 - 完全放弃50pts赏金是一种耻辱。

The other solution is another webbrowser control: http://code.google.com/p/geckofx/ 另一个解决方案是另一个webbrowser控件： http ： //code.google.com/p/geckofx/

Embeding Firefox Brower In C# Using GeckoFX 使用GeckoFX在C＃中嵌入Firefox浏览器

WebBrowser控件和嵌入标签

问题描述

3 个解决方案

解决方案1
2 已采纳 2012-06-17 02:36:28

解决方案2
1 2012-06-10 06:07:47

解决方案3
1 2012-06-17 02:19:44

WebBrowser控件和嵌入标签

问题描述

3 个解决方案

解决方案1 2 已采纳 2012-06-17 02:36:28

解决方案2 1 2012-06-10 06:07:47

解决方案3 1 2012-06-17 02:19:44

解决方案1
2 已采纳 2012-06-17 02:36:28

解决方案2
1 2012-06-10 06:07:47

解决方案3
1 2012-06-17 02:19:44