R – Win32: How to use RegisterTypeLib API from standard user

securitywinapi

The Win32 API call RegisterTypeLib() is used to create the registry keys necessary to register a type library.

Unfortunatly, on Windows XP, it tries to write those registry key entries to

HKEY_CLASSES_ROOT\TypeLib

rather than

HKEY_CURRENT_USER\Software\Classes\TypeLib

Meaning that a standard user will not be able to run an ActiveX.

In May 2008 Microsoft released a hotfix for Vista to correct this issue – but the problem remains on Windows XP.

What's a standard-user friendly developer to do?

Answer 1

Use the API call that is designed for it:

RegisterTypeLibraryForUser()

Answer 2

If you can't fix it, hack it:

//begin hack
HKEY key;
RegOpenKeyW(HKEY_CURRENT_USER, @"Software\Classes", out key);
RegOverridePredefKey(HKEY_CLASSES_ROOT, key);

//do original work
RegisterTypeLibrary(...)

//stop hacking
RegOverridePredefKey(HKEY_CLASSES_ROOT, null);
RegCloseKey(key);

Best Solution

You can use the RegOverridePredefKey() API to map the HKEY_CLASSES_ROOT regtree to HKEY_CURRENT_USER\Software\Classes:

http://msdn.microsoft.com/en-us/library/ms724901.aspx

Related Solutions

Php – How to sanitize user input with PHP

It's a common misconception that user input can be filtered. PHP even has a (now deprecated) "feature", called magic-quotes, that builds on this idea. It's nonsense. Forget about filtering (or cleaning, or whatever people call it).

What you should do, to avoid problems, is quite simple: whenever you embed a a piece of data within a foreign code, you must treat it according to the formatting rules of that code. But you must understand that such rules could be too complicated to try to follow them all manually. For example, in SQL, rules for strings, numbers and identifiers are all different. For your convenience, in most cases there is a dedicated tool for such an embedding. For example, when you need to use a PHP variable in the SQL query, you have to use a prepared statement, that will take care of all the proper formatting/treatment.

Another example is HTML: If you embed strings within HTML markup, you must escape it with htmlspecialchars. This means that every single echo or print statement should use htmlspecialchars.

A third example could be shell commands: If you are going to embed strings (such as arguments) to external commands, and call them with exec, then you must use escapeshellcmd and escapeshellarg.

Also, a very compelling example is JSON. The rules are so numerous and complicated that you would never be able to follow them all manually. That's why you should never ever create a JSON string manually, but always use a dedicated function, json_encode() that will correctly format every bit of data.

And so on and so forth ...

The only case where you need to actively filter data, is if you're accepting preformatted input. For example, if you let your users post HTML markup, that you plan to display on the site. However, you should be wise to avoid this at all cost, since no matter how well you filter it, it will always be a potential security hole.

How does the SQL injection from the “Bobby Tables” XKCD comic work

It drops the students table.

The original code in the school's program probably looks something like

q = "INSERT INTO Students VALUES ('" + FNMName.Text + "', '" + LName.Text + "')";

This is the naive way to add text input into a query, and is very bad, as you will see.

After the values from the first name, middle name textbox FNMName.Text (which is Robert'); DROP TABLE STUDENTS; --) and the last name textbox LName.Text (let's call it Derper) are concatenated with the rest of the query, the result is now actually two queries separated by the statement terminator (semicolon). The second query has been injected into the first. When the code executes this query against the database, it will look like this

INSERT INTO Students VALUES ('Robert'); DROP TABLE Students; --', 'Derper')

which, in plain English, roughly translates to the two queries:

Add a new record to the Students table with a Name value of 'Robert'

and

Delete the Students table

Everything past the second query is marked as a comment: --', 'Derper')

The ' in the student's name is not a comment, it's the closing string delimiter. Since the student's name is a string, it's needed syntactically to complete the hypothetical query. Injection attacks only work when the SQL query they inject results in valid SQL.

^{^{Edited again as per dan04's astute comment}}