KEMBAR78
Active scripting | PDF
[R.I.P. IE8] Active Scripting
JSer.info event @ Jan 2016
Congratulation
jser.info 5 years!
IE 4-8 Architecture
• HTML Parse and Render …
MsHtml
• Browser UX … BrowseUI /
ShDocVw -> IEFrame (IE7+)
• Networking Stack … WinInet and
UrlMon
• Scripting … Active Scripting Host
APIs by IE
• Web Browser controls using COM APIs
• Browser Helper Object (BHO) APIs for browser extension (ex. Toolbar
etc)
• Pluggable Protocol Moniker
• ActiveScripting
Active Scripting
• COM interfaces to bind scripting engine
• For Engine API
• For Host API
• Used by
• IE (3?-8)
• Windows Scripting Host
• Active server page (IIS)
• Office
• 3rd party Apps
Backends
• By Microsoft
• JScript
• VBScript
• By 3rd party
• Ruby
• Python
• Perl
• PHP
• etc
Security?
<script language=“python”>
import __builtin__
myfile = __builtin__.open(“c:¥¥autoexec.bat”)
document.write(str(myfile.readlines()))
myfile.close()
</script>
http://www.python.jp/pipermail/python-ml-jp/2002-
January/000977.html
COM Interfaces
• IE uses IDispatchEx interface to access methods and properties
• As IE, Script was a kind of COM
this access from Host Apps (IE)
// Invoke method with "this" pointer
DISPID putid = DISPID_THIS;
VARIANT var;
DISPPARAM disparams;
IDispatchEx* pdexObj;
var.vt = VT_DISPATCH;
var.pdispVal = pdispObj;
dispparams.rgvarg = &var;
dispparams.rgdispidNamedArgs = &putid;
dispparams.cArgs = 1;
dispparams.cNamedArgs = 1;
pdexObj->InvokeEx(dispid, LOCALE_USER_DEFAULT, DISPATCH_METHOD, &dispparams,
NULL, NULL, NULL);
Implement Scripting Engine
• Engine must implement IAcriptScript* interfaces such as
IActiveScriptHost etc
• When using on IE, mark as safe like ActiveX control
Debugger Support
• Debugging APIs (COM APIs) to integrate IDE
• Profiler API is IE9+
• PDM (Process Debug Manager)
Conclusion
• Active Scripting is the binding interface used by IE8 (not IE9+)
• APIs is for host, engine and debugging
• Bye Bye IE8!
References
• Windows Script interfaces
• https://msdn.microsoft.com/en-us/library/fdee6589%28v=vs.94%29.aspx
• Active Scripting APIs: Add Powerful Custom Debugging to Your Script-
Hosting App
• https://msdn.microsoft.com/en-us/library/bb984890.aspx
• Microsoft Press – Inside Windows Debugging

Active scripting

  • 1.
    [R.I.P. IE8] ActiveScripting JSer.info event @ Jan 2016
  • 2.
  • 3.
    IE 4-8 Architecture •HTML Parse and Render … MsHtml • Browser UX … BrowseUI / ShDocVw -> IEFrame (IE7+) • Networking Stack … WinInet and UrlMon • Scripting … Active Scripting Host
  • 4.
    APIs by IE •Web Browser controls using COM APIs • Browser Helper Object (BHO) APIs for browser extension (ex. Toolbar etc) • Pluggable Protocol Moniker • ActiveScripting
  • 5.
    Active Scripting • COMinterfaces to bind scripting engine • For Engine API • For Host API • Used by • IE (3?-8) • Windows Scripting Host • Active server page (IIS) • Office • 3rd party Apps
  • 6.
    Backends • By Microsoft •JScript • VBScript • By 3rd party • Ruby • Python • Perl • PHP • etc
  • 7.
    Security? <script language=“python”> import __builtin__ myfile= __builtin__.open(“c:¥¥autoexec.bat”) document.write(str(myfile.readlines())) myfile.close() </script> http://www.python.jp/pipermail/python-ml-jp/2002- January/000977.html
  • 8.
    COM Interfaces • IEuses IDispatchEx interface to access methods and properties • As IE, Script was a kind of COM
  • 9.
    this access fromHost Apps (IE) // Invoke method with "this" pointer DISPID putid = DISPID_THIS; VARIANT var; DISPPARAM disparams; IDispatchEx* pdexObj; var.vt = VT_DISPATCH; var.pdispVal = pdispObj; dispparams.rgvarg = &var; dispparams.rgdispidNamedArgs = &putid; dispparams.cArgs = 1; dispparams.cNamedArgs = 1; pdexObj->InvokeEx(dispid, LOCALE_USER_DEFAULT, DISPATCH_METHOD, &dispparams, NULL, NULL, NULL);
  • 10.
    Implement Scripting Engine •Engine must implement IAcriptScript* interfaces such as IActiveScriptHost etc • When using on IE, mark as safe like ActiveX control
  • 11.
    Debugger Support • DebuggingAPIs (COM APIs) to integrate IDE • Profiler API is IE9+ • PDM (Process Debug Manager)
  • 12.
    Conclusion • Active Scriptingis the binding interface used by IE8 (not IE9+) • APIs is for host, engine and debugging • Bye Bye IE8!
  • 13.
    References • Windows Scriptinterfaces • https://msdn.microsoft.com/en-us/library/fdee6589%28v=vs.94%29.aspx • Active Scripting APIs: Add Powerful Custom Debugging to Your Script- Hosting App • https://msdn.microsoft.com/en-us/library/bb984890.aspx • Microsoft Press – Inside Windows Debugging