The case of the missing context menu verbs

A customer reported that when they right-clicked a batch file, a bunch of commands were missing. For example, Open was gone!

Okay, there really isn't much of a story here, because some direct debugging quickly identified the culprit.

The customer had installed a third party shell extension which returned a huge value from its IContext­Menu::Query­Context­Menu method.

Explorer told the shell extension, "Hey, like I've got room for 30,000 menu items. How many do you need?"

The shell extension replied, "I'll take 29,995 of them."

And so the shell extension sucked up nearly all the menu IDs, and by the time the Open command handler came along, the context menu host said, "Sorry, I'm all out."

If you followed along when we created a composite context menu, you could sort of see this problem coming.

Uninstalling the buggy shell extension fixed the problem.

Comments (21)
  1. Joshua says:

    Didn't they test their own code?

    [They probably tested on a system with fewer than 5 context menu extensions. "We left room for five!" -Raymond]
  2. Gabe says:

    So you think that this may have been on purpose ("We checked many files on our system, and none of them have more than 5 context menu verbs")?

    [No, not on purpose. But if you don't test the case where the problem occurs, then testing won't find the problem. -Raymond]
  3. Katie says:

    Who knows how they ended up with the big number, but I'm amused at the thought that their first tests failed, but they decided that other third-party extensions were the problem. After all, their code works on a fresh install, but then breaks when you install other extensions!

  4. Anon says:


    You'd might be sad to discover that that's how 99% of QA works…

    "It works on a clean VM with literally nothing other than the OS and our product installed, so clearly there's nothing wrong with our product!"

  5. Joshua says:

    [They probably tested on a system with fewer than 5 context menu extensions. "We left room for five!" -Raymond]

    Apparently their source control system doesn't have a shell plugin then.

  6. Paul says:

    @Joshua That's assuming they're using source control at all, a fact not currently in evidence.

    Personally I was guessing they were just returning stack garbage that happened to have a consistent value by accident. But I think it's funnier that they would carefully leave 5 slots for any extensions that might come after them in the shell's asking order. Although I'm kind of surprised that the built-in verbs like Open wouldn't always be first to protect from this case.

  7. xpclient says:

    Explorer could do with a "no addons" mode for troubleshooting problematic shell extensions like Internet Explorer has for addons. And an official shellex manager to enable/disable them too. Then again not a chance of this happening as now we're in the age of uber dumbed down UIs – something like this would be offering too much power/control over the system to the end user. Microsoft can't have users having that much control!

  8. Nick says:

    "Uninstalling the buggy shell extension fixed the problem."

    Ah, the "And they lived happily ever after" ending for the vast majority of Explorer problems :)

  9. Anon says:

    @Paul @Joshua

    That's also assuming that anyone actually uses the shell extension for source control, which isn't likely.

  10. KS says:

    Well, why does the shell allow this? Why doesn't it handle this functionality? e.g. "give me some menu text to display and a command and I'll add it to the context menu for you". This way you can't claim 29990 empty slots. You just get what you ask for in terms of filled items. Or why doesn't the shell check after addition how many entries actually have been added and reclaims the unused ones? Or simply use a safe limit of 100 or so per extension? (I've never seen an extension use more than, say, 20 or 30 entries.)

    [How would you reclaim an unused one? Maybe it's not currently used but will be added dynamically later? At any rate, shell extensions run with full trust (since they run in-process) so there is a limit to what you can do to stop them from doing bad things. -Raymond]
  11. @KS: probably because features are not implemented by default. Why does my car allow me to open the door while I'm driving at 50 mph?

  12. Wisefaq says:


    ["It works on a clean VM with literally nothing other than the OS and our product installed, so clearly there's nothing wrong with our product!"]

    That's how you package an application up for distribution.  That way you catch any unexpected dependencies (for example .Net).  You then test on a representative sample of PCs in the field, which is what I guess is the point you were getting at.

  13. Evan says:

    @Anon: "That's also assuming that anyone actually uses the shell extension for source control, which isn't likely."

    What? Tortoise{SVN,Git} is awesome! And yeah, you can easily wind up with several context menu entries from them.

    (Probably the other TortoiseBlahs are too, but besides TortoiseCVS which sucks because it's building on something that sucks, I haven't used them.)

  14. Ken Hagan says:

    @Wisefaq: Yes, and I was reading only last week that the "Client Profile" was dropped from .NET 4.5 (so only the "full" installer exists) because MS found that so many people were shipping the CP when they actually had dependencies that required the full version. One has to presume that these were all tested only on unclean machines (probably the developer's) because the problem shows up 100% reliably as "won't even run" if you install it on a clean machine.

    There appears to be no limit to how bad programmers can be and still earn a living.

  15. cheong00 says:

    @xpclient: You can run Autoruns from SysInternals Suite to disable all non-Microsoft extensions then enable it one by one.

  16. Gabe says:

    Evan: I'm assuming that Anon meant that the developer of the culprit shell extension likely doesn't use source control. I figured it's safe to assume that the sort of people who write buggy shell extensions like that also don't use source control.

  17. xpclient says:

    @cheong00, sure there is and there's also Nirsoft's Shellexview :)

  18. John Doe says:

    @Ken Hagan, or the IT department won't allow the programmer to do its job:…/Mordac%20The%20Preventer (it's actually quite sad how real this is…)

  19. JamesNT says:

    There are days when it really wouldn't hurt my feelings if MS banned third-party shell extensions.  Of course, I realize this might be a case of the cure being worse than the disease, but still…


  20. Dave Bacher says:


    Actually, what I'd like to see copied is Internet Explorer/Chrome/Firefox's "click-to-run."


    The plug-in "Crash-You" from "Contoso, LLC" is now available for use. [Enable] [Disable]

    Basically, a proxy that returns E_ACCESS_DENIED or w/e by default — some signal to Internet Explorer that "hey, this hasn't been approved yet."  When the user clicks Enable, then do the initialization.  To see what I'm talking about, take a clean Windows 8.1 machine and install Skype desktop — when you start Internet Explorer, you'll get a prompt:

    The plug-in "Click to Call" from "Microsoft Corporation" is now available. [Enable] [Disable]

    Similarly, it would be nice on startup for Explorer to break down what's slowing it down.  For example, Tortoise Git actually has a measurable impact on startup.

    As for how this happens, I think I've been at that meeting…

    Alice> We need to write some context menu options for Super Fabrikam Pro Ultra Mega Edition

    Bob> Does anyone use those anyway?

    Alice> Well, our metric server has been offline and the IP address in our "A" record's been pointed at some server in China, so we don't actually have metrics or crash reports so… we'll just assume yes.

    Bob> Oh, OK, that sounds like a reasonable plan.

    Alice> So Microsoft makes us say how many we need, how many should I report?

    Bob> Well lets make an option screen, and on there let the user pick from a bunch of checkboxes which options they want to appear, and in what order.  Lets have a plethora of checkboxes, everyone loves checkboxes.

    Alice> Sure!  sounds good, so what number do we give?

    Bob> I'm pretty sure it doesn't matter, what's the upper limit?

    Alice> It says here 30000.

    Bob> OK, so we'll tell them 29995.  That'll be a good compromise.

    Alice> Awesome, 29995 it is.

  21. KlimaxDanielix says:

    I have Tortoise*, where * stands for CVS, SVN, GIT, Bazaar, Hg. Sometimes standard 17' has insufficient height for entire Context Menu… :D

    (+few more extensions.)

Comments are closed.

Skip to main content