WebBrowser control: Block a specific ActiveX control from loading

Question

I am hosting the WebBrowser control (using ATL), and I'm looking for a way to block a specific ActiveX control (by CLSID) from loading.

I know ProcessUrlAction can block ActiveX controls, but that's for the entire URL, it doesn't appear to allow you to block a specific ActiveX control by CLSID.

I don't see any specific event interfaces that get notified in MSHTML or the WebBrowser control.

Right now the only solution I can think of is to hook CoCreateInstanceEx and try to block it there.

Any simpler ideas?

Answer 1

ProcessUrlAction can block individual controls as well, you need to check if dwAction=URLACTION_ACTIVEX_RUN, if so then pContext will have the CLSID of the control that is about to run. If it's the one you want to block then set pPolicy to URLPOLICY_DISALLOW and return S_FALSE:

static CLSID CLSID_BAD = {0x00000000, 0x0000, 0x0000, {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}};
STDMETHOD(ProcessUrlAction)(LPCWSTR pwszUrl, DWORD dwAction, BYTE *pPolicy, DWORD cbPolicy, BYTE *pContext, DWORD cbContext, DWORD dwFlags, DWORD dwReserved)
{
    if(URLACTION_ACTIVEX_RUN == dwAction && CLSID_BAD == *(CLSID *)pContext)
    {
        *pPolicy = URLPOLICY_DISALLOW;
        return S_FALSE;
    }
    return INET_E_DEFAULT_ACTION;
}