Embed-tag referring to dynamic rendered SVG content is blocked in IE6

Embed-tag referring to dynamic rendered SVG content is blocked in IE6

Secure Home | Search | About
 Microsoft Applications Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
Embed-tag referring to dynamic rendered SVG content is blocked in IE6 Daniel 03-20-2006
Posted by Daniel on March 20, 2006, 9:11 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Hi all,
I have a problem regarding the embed tag using IE6 with most recent security
patches running on a Windows XP.

The following scenario lets me loose hours figuring out the reason, why it
doesn't work :-( :

I have a simple ASPX-page containing an EMBED-tag, which refers to another
page, which dynamically creates SVG code.

<html>
<embed src="svgContent.aspx" id=svg width="888" height="1050"
type="image/svg+xml" />
</html>

This worked fine until a few weeks ago. Until then, IE 6 just shows an empty
page. No errors, no nothing, only a
white readonly frame with no content. Checking the html-protocol it seems,
IE just doesn't adress the "svgContent.aspx" at all. It's not even trying to
load the page. On an older machine, this works perfectly.
So I guess, it must be a security issue. But scanning the web I found
nothing that could give me a hint and what I could do making it work again.

Also, if I link the src attribute to static content, eg. helloworl.svg,
everything works perfectly. It seams, IE6 (or IIS6) realizes, that there is
dynamic
content and does not allow redirecting it to the SVG-ActiveX Control.

The svgContent.aspx looks something like this:

<script language="c#" runat="server">
protected override void Render(HtmlTextWriter writer)
{
string svgSource = Server.MapPath(@"svgsimple1.svg");

Response.ClearContent();
Response.ContentType = "image/svg+xml?";

System.IO.StreamReader reader = new
System.IO.StreamReader(svgSource);
string content = reader.ReadToEnd();
reader.Close();

Response.Write(content);
Response.Flush();
Response.End();
}
</script>

Of course, this sample makes not much sense, since I just load a static
svg-file. In the real application, the code is fully dynamically composed
and written into
the Response object.

These are the configurations:
Client:
- IE6 running on Windows XP SP2
- most recent security patches
- Adobe SVG Viewer 3.03 installed

Server:
Windows Server 2003 with IIS 6

Anybody has an idea, how to solve this problem?
Any help appreciated!

Thanks in advance
Daniel



Similar ThreadsPosted
Windows 2003 firewall - limiting the range of dynamic RPC ports February 17, 2006, 4:04 am
Re: Digital Content Security Act December 22, 2005, 5:12 am
JS file content found on my PC July 23, 2008, 4:02 am
Scanning of encrypted content August 8, 2008, 1:09 pm
Internet Explorer/Content Advisor Help November 28, 2005, 11:19 am
View content of PKCS#12 file (.pfx) July 3, 2006, 10:09 am
Content Advisor-Supervisor Password March 15, 2007, 1:34 pm
read/modify port 113 Ident content? December 2, 2006, 3:29 pm
Bug: no hint displayed when "Content Advisor" is activated in Win October 23, 2007, 10:37 am
how to issue certificates based on the content of certificate request January 25, 2008, 5:28 pm

The site map in XML format XML site map

Contact Us | Privacy Policy