Re: VBScript Error in MSIE 4 (Mac)

[Aaron Salo]

> At 12:55 PM 2/20/98 +0900, Bob James wrote:
>
> >It looks like a bug: if it does not support, why does it read the <Script>-Tag??!
>It's not a bug, it's a feature! <g>


I have no love for Uncle Bill, but in this case it IS a feature. By using the


CreateObject("Scripting.FileSystemObject")


method in VBScript I can reach out and pave any file in your machine that I know the name of. Far as Mac - I cannot say. In the case of Windoze, a fun target is always autoexec.bat. Or config.sys. Or use your imagination...point is, that when you're creating an object, you're basically using the potential to make an activeX control on the fly, along with the ability to write to the file system. If MSIE security is set to none, poof. File gone. Or replaced with something really bad. Like putting a line in autoexec.bat to do a deltree *.* or format the HD next time the user reboots. With security set to medium, you get the warning dialog and hopefully a user would decline to run your code. I hope.


Short version is that if I don't know you or your code, I think I'll keep the condom on...and to encourage people to have unsafe sex just so your script will crank might be irresponsible. Use another method.


just my .02

___a_c_t_i_V_o_x______________________________________

Aaron Salo   actiVox new media  http://www.activox.com

PO Box 1824   Poulsbo WA USA 98370   +1.360.415.9598

aaronactivox [dot] com

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^