Security exception creating MSHTML HtmlDocumentClass()

Discussion in 'ASP.NET 2.0' started by Bruce, Mar 9, 2007.

  1. Bruce

    Bruce DiscountASP.NET Staff

    You cannot use this COM for security reason. MSHTML is the IE rendering engine.


    The default security policy on Windows 2003 server disable browsing with IE on the server because of obvious reasons (virus, malware, etc.). THe same policy applies to any application using MSHTML.


    What are you trying to do with your application? We may be able to give you some alternative if you can give us more details.

    Bruce

    DiscountASP.NET
    www.DiscountASP.NET
     
  2. Thanks for the info.
    We basically use mshtml to parse *.htm files, looking for <table> contents
    in all parts of the page, including <frames>, if any.
    When tables are located we use mshtml to parse them, traversing all their <tr> rows and <td> cells.
    All this to fill a chart server-side from a remote *htm url or file

    I guess we could develop a simple parser, but htmldocument was easy to use, and we're lazy <grin>

    regards
    david
    www.chartAll.com
     
  3. Ya you can't use that. It actually creates a little browser and renders the HTML in it. Works ok for desktop apps,not so good for web server apps.


    Joel Thoms
    DiscountASP.NET
    http://www.DiscountASP.NET
     
  4. Hi
    I get this security exception that works fine in my localhost development machine:

    'System.UnauthorizedAccessException: Retrieving the COM class factory for component with CLSID {25336920-03F9-11CF-8FD0-00AA00686F13} failed due to the following error: 80070005. '

    I have a reference to Microsoft.MSHTML.dll assembly, (assembly is at my \bin folder), and the code is:

    IHTMLDocument2 doc = new HTMLDocumentClass();

    I guess IUSR_xxx does not have permission to create classes that use COM.

    Is there an alternative?

    regards
    david
     
  5. It works wonderfully on our development local machines. Takes very few milliseconds to parse a page and it does the job right and efficiently.
    It is sad it is not possible to use at our discountasp.net account 'for security reasons'.
    We'll have to redirect this call to a web service at our other servers where we can give permissions, but then data will have to travel one more step.

    regards
    david
    www.chartAll.com
     
  6. There's A LOT of downsides to using this control, it uses wininet, only 2 simulatenous connetions, etc.


    No other shared hosts willlet you do this either.



    Joel Thoms
    DiscountASP.NET
    http://www.DiscountASP.NET
     
  7. Bruce

    Bruce DiscountASP.NET Staff

    Some host will allow you to do that but you probably want to be aware of them because they do not take security seriously.


    Bruce

    DiscountASP.NET
    www.DiscountASP.NET
     
  8. Hi Bruce
    You're totally right. I've rewritten the code using .Net System.Xml namespace classes instead,
    so no COM/security problems anymore.

    The only drawback is instead of supporting normal 'relaxed' html it now requires
    well-formed XHTML, which is just a minor annoyance but overall it works fine.

    thanks and regards !
    david
    www.chartAll.com
     
  9. Using XMLHTTP, there's a way to return theresponseText instead of the XML. So it does not have to be well formed.





    Joel Thoms
    DiscountASP.NET
    http://www.DiscountASP.NET
     

Share This Page