Suprisingly, JavaScript Code could execute any process it want. Why? - Stack Overflow

admin管理员组

文章数量:1287801

I asked "How to run a executable file from a web page?"

Many people told me that's impossible, but my colleague find a piece of JavaScript code that could execute any process. I can not believe ActiveX is so dangerous.

How could this happen? Why this is not forbidden by IE?

    <SCRIPT   language=JavaScript>   
  function   Run(strPath)   {   

  try   {   
  var   objShell   =   new   ActiveXObject("wscript.shell");   
  objShell.Run(strPath);   
  objShell   =   null;   
  }   
  catch   (e){alert('Can not find "'+strPath)   

  }   
  }   
  </SCRIPT>   

  <BUTTON   class=button   onclick="Run('notepad')">notepad</BUTTON><br>   
  <BUTTON   class=button   onclick="Run('mspaint')">mspaint</BUTTON><br>   
  <BUTTON   class=button   onclick="Run('calc')">calc</BUTTON><br>   
  <BUTTON   class=button   onclick="Run('format c:')">format c:</BUTTON><br>   

I asked "How to run a executable file from a web page?"

Many people told me that's impossible, but my colleague find a piece of JavaScript code that could execute any process. I can not believe ActiveX is so dangerous.

How could this happen? Why this is not forbidden by IE?

    <SCRIPT   language=JavaScript>   
  function   Run(strPath)   {   

  try   {   
  var   objShell   =   new   ActiveXObject("wscript.shell");   
  objShell.Run(strPath);   
  objShell   =   null;   
  }   
  catch   (e){alert('Can not find "'+strPath)   

  }   
  }   
  </SCRIPT>   

  <BUTTON   class=button   onclick="Run('notepad')">notepad</BUTTON><br>   
  <BUTTON   class=button   onclick="Run('mspaint')">mspaint</BUTTON><br>   
  <BUTTON   class=button   onclick="Run('calc')">calc</BUTTON><br>   
  <BUTTON   class=button   onclick="Run('format c:')">format c:</BUTTON><br>   

• javascript

Share Improve this question Follow edited May 23, 2017 at 12:19 CommunityBot 111 silver badge asked Jul 31, 2009 at 9:13 LeafGlowPathLeafGlowPath 3,79999 gold badges4141 silver badges5959 bronze badges 2

• 1 A friend of mine even saved an executable in C:/ using ActiveXObject. And there was no special level of restrictions. Settings were from "factory". – Ionuț G. Stan Commented Jul 31, 2009 at 9:17
• Why is this possible? Because IE sucks really hard! – Tim Büthe Commented Jul 31, 2009 at 10:30

Add a ment  | 

5 Answers 5

Sorted by: Reset to default 6

While you can do this IE will block it saying that there is an

ActiveX Control is trying to access you puter, click here for options

You can only run these if the end user allows them too and hopefully people are clever enough not to allow it to run. If you do allow it then there is always another alert asking if you really want to run this so there should be enough security around it.

Local files run in a different security environment than remote files, so while that will work if you save the file as an html and open it from your puter, if you upload it on a server and try to run it from there it will not work.

Did you try this?

wscript.shell can't be used in this way from a web page loaded remotely. If you loaded the web page from a local file or have changed your security settings it might work but it won't work when loaded from a remote web server.

The good news is IE8 blocks this behaviour, even with a local file. I don't know about IE7, though I would imagine this is also the case. I would doubt it would work with a remote file, even with IE6, otherwise we would have had some major incident by now and a patch would have been issued.

Its depends on your browser's security configuration. In some cases this peace of code will not be executed. But anyway user will be asked to allow ActiveX to run external process:

ActiveX Control is trying to access you puter, click here for options

本文标签： SuprisinglyJavaScript Code could execute any process it want WhyStack Overflow