Tricks with Mark of the Web: Behaviors, XML files

  • Article

A new feature of Internet Explorer is the Local Machine lockdown that blocks by default the execution of scripting in HTML pages. It is implemented in Windows XP SP2 and Windows Server 2003 (and future versions of Windows/IE). If you just load in IE a local HTM file with scripts in it, you will see an annoying yellow bar at the top of the document saying "To help protect your security, Internet Explorer has restricted this document from showing active content that could access your computer". The HTML will be displayed, but no scripts will be executed.

But sometimes the local machine zone is too restrictive, especially during development. You cannot use it to execute scripts in a local HTML that you edited. So if you really want to execute scripts in that page, you can enable scripting using by adding the following additional comment (called Mark of the Web):

 <!-- saved from url=(0023)https://www.contoso.com/  -->

This will work as long as the security settings of the local machine zone are less restrictive than the security settings of the URL mentioned in MotW. This URL will allow the HTML to be run in the Internet zone:

<!-- saved from url=(0014)about:internet -->

And this one to run in a Local Intranet zone:

<!-- saved from url=(0014)https://localhost/ -->

There is also a related post on MotW on IEBlog: here.

Tricks with MotW

Here is a trick that I just found out. If your HTML uses other HTC files (containing HTML components) then you need to add MotW to both the HTML and the HTC files, otherwise the scripts won't work.

Not only that, but MotW is useful also when viewing XML files! It seems weird to add a HTML-specific construct to an XML file, but it is very useful. When you open a plain XML file, IE will load a specific stylesheet to display the XML in a nicely formatted way. Not only that, but this stylesheet defines +/- buttons that allows you to expand/collapse various parts of the document. The problem is that the scriptable part of the stylesheet doesn't really work on XP SP2 for the reason mentioned above. If you double-click a local XML file, you will see again the annoying yellow bar, and +/- won't work. But if you add the MotW in the XML, the XML will now load nicely.