'Dynamic HTML in WPF WebBroswer - conent set by BrowserBehavior.Html, linking to file:/// url - does not behave

I am working on a system that has a WPF WebBrowser that is displaying dynamically generated HTML. This contains links to files, using file:///servername/filename.ext addresses.

This should have worked in times gone by when this was first developed, but does not seem to behave now.

What I can see:

  • White click on the generated file in the browser of being an HTML file: File is served from about:blank and in the Internet Zone. Clicking a link does nothing.

What I have done:

  • I have added about:blank to the Trusted Zone, and have set the security for the Trusted Zone to Low. Clicking a link still does nothing.
  • Created an HTML file and hosted it on my local IIS. Browse to this file in IE. The file contains a link to a file:/// address. Nothing happens on click.
  • Added http://127.0.0.1 to the Trusted Zone. The above test still fails.
  • Changed the generated HTML to be a link to http://www.google.com. This works.

What I think is happening:

  • The WPF WebBrowser is IE underneath. Did IE have a security update that stopped access to file:/// paths?

What I cannot do due to technical restrictions with deployment:

  • Have the generated HTML and the files linked to served by a web server so everything is within an http(s) environment.

What I can do:

  • Update browser settings
  • Update our code

Update - additional information:

  • The HTML is being displayed on the WPF by binding to a string that contains the HTML (effectively <html><body>Look! Stuff!<br /><a href="file:///foo/whatever.txt">Whatever</a></html>)
  • file:///foo/whatever.txt exists and I have access to it
  • That file is generated by a process on a server and the client is generating the link to the file. This is a historic design, I didn't come up with it, I'm just maintaining it. I can't do massive code overhauls.
  • I cannot install any additional services anywhere
c++sharpwpfwebbrowser-control


Solution 1:[1]

All Browsers have updated to prevent interesting stuff happening on local HTML files. Because you could do interesting stuff in the past it meant interesting exploits could be utilized too.

I've had a recent issue where I created a HTML in code and wanted to display it in CEFSharp (much better than WebBrowser by the way) with a link to CSS and JavaScript Files.

How I fixed it was to run a LocalHost and did this using this code which works really well: An HTTP file server (130 lines of code) in VB.Net

For testing your HTML outside of code you could run this batch file to start your LocalHost:

ECHO OFF
ECHO "Launching Localhost:8080"
py -3 -m http.server
ECHO "Loading HTML.."
start chrome localhost:8000

This batch file assumes you have Python 3+ installed. You can verify this in the Command Prompt with:

python --version

Solution 2:[2]

I've solved this by cheating a little.

I've got the VM to write the HTML out to a file, and then pass the file name to the browser in the view. This means that I am displaying the created content from file:////foo.htm, and that is fine for links to file:///server/bar

Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution Source
Solution 1
Solution 2 Paul Evans

Related Questions