W3C home > Mailing lists > Public > public-webappsec@w3.org > June 2013

[webappsec] plugin-types directive for CLSIDs in IE

From: Hill, Brad <bhill@paypal-inc.com>
Date: Tue, 4 Jun 2013 00:18:42 +0000
To: "public-webappsec@w3.org" <public-webappsec@w3.org>
Message-ID: <370C9BEB4DD6154FA963E2F79ADC6F2E27AE339D@DEN-EXDDA-S12.corp.ebay.com>
Issue-50 in our WebAppSec tracker refers to the need to specify syntax for using the plugin-types directive (https://dvcs.w3.org/hg/content-security-policy/raw-file/tip/csp-specification.dev.html#plugin-types) with IE when it uses the CLSID method for identifying ActiveX embeds.  

I wonder if David Ross, Jacob Rossi or someone else at Microsoft can help us resolve this?

We could just allow a syntax much like the classid attribute, ("clsid: D27CDB6E-AE6D-11cf-96B8-444553540000") but perhaps no change is needed?

The Windows Registry under \\HKEY_CLASSES_ROOT\MIME\Database\Content Type\ has mappings from MIME Types to CLSIDs.  Are these reliably populated? (there seem to be a lot of them on my machine)  Can IE just use this to determine what CLSIDs are implied by a given MIME type in a plugin-types directive?

Thanks,

Brad
Received on Tuesday, 4 June 2013 00:19:16 UTC

This archive was generated by hypermail 2.3.1 : Monday, 23 October 2017 14:54:02 UTC