Registering an Application to a URL Protocol.docx

1、Registering an Application to a URL ProtocolRegistering an Application to a URL Protocol426 out of 457 rated this helpful-Rate this topicUpdated: April 2011TheAbout Asynchronous Pluggable Protocolsarticle describes how to develop handlers for URL protocols. In some cases, it may be desirable to invo

2、ke another application to handle a custom protocol. To do so, register the existing application as a URL Protocol handler. After the application has successfully launched, it can use command-line parameters to retrieve the URL that launched it. These settings apply to protocol handlers launched from

3、 within Windows Internet Explorer and from Windows Explorer using theRmand (Windows logo key+R).Security AlertApplications that handle URL protocols must consider how to respond to malicious data. Because handler applications can receive data from untrusted sources, the URL and other parameter value

4、s passed to the application may contain malicious data that attempts to exploit the handling application.This topic contains the following sections: Registering the Application Handling the Custom Protocol Launching the Handler Security Issues Example Protocol Handler Related TopicsRegistering the A

5、pplication Handling the Custom ProtocolTo register an application to handle a particular URL protocol, add a new key, along with the appropriate subkeys and values, to HKEY_CLASSES_ROOT. The root key must match the protocol scheme that is being added. For instance, to add an alert: protocol, add ana

6、lertkey to HKEY_CLASSES_ROOT, as follows:HKEY_CLASSES_ROOTalertURL Protocol=Under this new key, theURL Protocolstring value indicates that this key declares a custom protocol handler. Without this key, the handler application will not launch. The value should be an empty string.Keys should also be a

7、dded forDefaultIconandshell. The Default string value of theDefaultIconkey must be the file name to use as an icon for this new URL protocol. The string takes the form path, iconindex with a maximum length of MAX_PATH. The name of the first key under theshellkey should be an action verb, such asopen

8、. Under this key, acommandkey or aDDEEXECkey indicate how the handler should be invoked. The values under thecommandandDDEEXECkeys describe how to launch the application handling the new protocol.Finally, theDefaultstring value should contain the display name of the new protocol. The following examp

9、le shows how to register an application, alert.exe in this case, to handle thealertprotocol.HKEY_CLASSES_ROOTalert(Default) = URL:Alert ProtocolURL Protocol=DefaultIcon(Default) = alert.exe,1shellopencommand(Default) = C:Program FilesAlertalert.exe %1When a user clicks a link registered to your cust

10、om URL protocol, Internet Explorer launches the registered URL protocol handler. If the specifiedopencommand specified in the registry contains a%1parameter, Internet Explorer passes the URI to the registered protocol handler application.Launching the HandlerBy adding the above settings to the regis

11、try, navigating to URLs such asalert:Hello%20Worldwould cause an attempt to launch alert.exe with the complete URL on the command line. Internet Explorer decodes the URL, but the WindowsRmand does not. If a URL contains spaces, it may be split across more than one argument on the command line.For ex

12、ample, if the link above is followed through Internet Explorer, the command line would be:C:Program FilesAlertalert.exe alert:Hello WorldIf this link is followed through Windows Explorer, the WindowsRuncommand, or some other application, the command line would be:C:Program FilesAlertalert.exe alert:

13、Hello%20WorldBecause Internet Explorer will decode all percent-encoded octets in the URL before passing the URL toShellExecute, URLs such asalert:%3F?will be given to the alert application protocol handler asalert:?. The handler wont know that the first question mark was percent-encoded. To avoid th

14、is issue, application protocol handlers and their associated URL scheme must not rely on encoding. If encoding is necessary, protocol handlers should use another type of encoding that is compatible with URL syntax, such as Base64 encoding. Double percent-encoding is not a perfect solution either; if

15、 the application protocol URL isnt processed by Internet Explorer, it will not be decoded.WhenShellExecuteexecutes the application protocol handler with the URL on the command line, any non-encoded spaces, quotes, and slashes in the URL will be interpreted as part of the command line. This means tha

16、t if you use C/C+sargc and argvto determine the arguments passed to your application, the URL may be broken across multiple parameters. To mitigate this issue: Avoid spaces, quotes, or backslashes in your URL Quote the %1 in the registration (%1 as written in the alert example registration)However,

17、avoidance doesnt completely solve the problem of quotes in the URL or a backslash at the end of the URL.Internet Explorer9. An application protocol handler can disable URL percent decoding by adding theUseOriginalUrlEncodingsetting to the registration for the protocol. When this setting is set to (D

18、WORD)1, the command line is not percent decoded by Internet Explorer when passed to the protocol handler.WarningThe use (or lack) of URL percent encoding does not protect a protocol handler from malicious input. Care must be taken to properly validate input from untrusted sources.Security IssuesAs n

19、oted above, the URL that is passed to an application protocol handler might be broken across multiple parameters. Malicious parties could use additional quotation marks or backslash characters to pass additional command-line parameters. For this reason, application protocol handlers should assume th

20、at any parameters on the command line could come from malicious parties, and carefully validate them. Applications that could initiate dangerous actions based on external data must first confirm those actions with the user. In addition, handling applications should be tested with URLs that are overl

21、y long or contain unexpected (or undesirable) character sequences.For more information, please seeWriting Secure Code.Example Protocol HandlerThe following sample code contains a simple C# console application demonstrating one way to implement a protocol handler for thealertprotocol.using System;usi

22、ng System.Collections.Generic;using System.Text;namespace Alert class Program static string ProcessInput(string s) / TODO Verify and validate the input / string as appropriate for your application. return s; static void Main(string args) Console.WriteLine(Alert.exe invoked with the following paramet

23、ers.rn); Console.WriteLine(Raw command-line: nt + Environment.CommandLine); Console.WriteLine(nnArguments:n); foreach (string s in args) Console.WriteLine(t + ProcessInput(s); Console.WriteLine(nPress any key to continue.); Console.ReadKey(); When invoked with the URLalert:Hello%20World(note extra q

24、uotes) from Internet Explorer, the program responds with:Alert.exe invoked with the following parameters.Raw command-line: C:Program FilesAlertalert.exe alert:Hello WorldArguments: alert:Hello WorldPress any key to continue.Related Topics About Asynchronous Pluggable Protocols Debugging Tips窗体顶端Did

25、you find this helpful? YesNo窗体底端Community ContentAddFAQCan we register multiple application by using the same prefix and allow users select an app to runDear All, Ive created a URL protocol for my app successfully. Because my app uses URL prefix vnc:/, this may conflict with other VNCs if they also

26、register URL protocol too. Can we have a way to register multiple application by using the same prefix and allow users select an app to run? Thanks, StephenHistory 2/24/2012 phanduysonSome Executables DisabledIn Windows 7 / IE 9, c:windowssystem32cmd.exe cannot be invoked as the handler. In my case,

27、 I was trying to pass the URI to a batch file, so my command wasc:windowssystem32cmd.exe /c c:mystufffoohandler.bat %1. I was able to work around this by making a copy of cmd.exe. My command became c:mystufffoohandler_cmd.exe /c c:mystufffoohandler.bat %1, which worked. I dont know if this restricti

28、on comes from Windows 7 or IE9, and I would not be surprised if other command processors, like cscript.exe, are likewise disabled.History 10/6/2011 Louis ThomasHow to remove Open Application - Security Warning window in IEI have registered a URL protocol, and it works well. But when i invoke my appl

29、iction in the web page, ie open asecurity warning dialog.So how to remove Open Application - Security Warning window in IE with codes. Thanks.History 6/8/2011 cjb9937write as a service?Hi;Is there a way to write a protocol handler as a service?thanks - daveHistory 5/18/2011 DavidThi808Working DIR?He

30、llo.Q: Is there a way to set the Working Directory for the program in the registry when launched from url?History 3/17/2011 Ult1m4t3Snip3r 3/18/2011 Ult1m4t3Snip3rHow to warn a user on a computer on which URL protocol is not registered?I have registered a URL protocol along with the application installation, and it works flawlessly on both IE and firefox. The problem is that on a computer on which the application is not installation( neitheris the URL protocol registered), and the user clicks the URL link. I would like the IE to open a javascript windows, or a web page, o