1

I have a webpage where when I click a button, it should download an exe from a url and the exe should get automatically invoked without user intervention.

In Internet Explorer I achieved this through activex control ( .ocx ) deployed as a .cab file.

I am planning to extend this to chrome and firefox platform too. ( atleast chrome for the first step ).

I don't want to use Java applet ( need to remove java dependency ). I know I could achieve this through Firebreath plugin but clearly this is not a good time to dive into NPAPI plugin ( since NPAPI is already being fading out. Chrome has begun phasing out NPAPI ).

When I looked into alternative Plugin technologies to NPAPI, I stumbled upon Google Native Client. On further reading I got to know Nacl too won't fit my needs since os calls api will not work in nacl ( I hope URLDownloadToFile api or createprocess or shellexecute wouldn't work. Correct me if I am wrong ).

Should I go for Native Messaging? Is there anyother alternative technology am missing ? Guide me Please .

Robert
  • 10,403
  • 14
  • 67
  • 117
Anantha Subramaniam
  • 196
  • 3
  • 17
  • 1
    I don't think any virusscanner is going to like this. And the browser people probably would view this as a security risk, too. – MSalters Apr 17 '14 at 14:57
  • 1
    _"it should download an exe from a url and the exe should get automatically invoked without user intervention"_ - bad idea from the start. There would be nothing to prevent you from auto-clicking the button and invoking the executable without the users consent. – Captain Obvlious Apr 17 '14 at 15:02
  • This is a major security risk. Whatever solution you end up with, you might risk getting blocked by browser vendors for security risks as well. – Georg Fritzsche Apr 24 '14 at 08:12

3 Answers3

1

NPAPI until it goes away will let you do what you want; other than that Native Messaging is the only option.

As others have mentioned, this is a Really Bad Idea(tm).

taxilian
  • 14,229
  • 4
  • 34
  • 73
1

Thanks all the people . I finally settled with Launch Application Using Custom Protocol Handler . http://msdn.microsoft.com/en-us/library/ie/aa767914(v=vs.85).aspx . This fitted my needs .

Anantha Subramaniam
  • 196
  • 3
  • 17
0

As suggested above, Chrome's native messaging appears to be the way to go - on Chrome.

First, have a look here: This blog entry shows that native messaging can be used to launch "calc.exe". I've yet to try it myself - but it looks promising: https://plus.google.com/+FrancoisBeaufort/posts/jdTrmmZL9Xh

One thing to keep in mind is that the Native Messaging technique will only work from a Chrome Extension, which opens up an entire set of related questions.

(1) Can Chrome extensions be installed for all users using group policy? or via the registry? -Yes, according to http://www.chromium.org/administrators/pre-installed-extensions Later edit: only "published" extensions can be added via the registry. see - https://developer.chrome.com/extensions/external_extensions

(2) Can you detect whether an extension is already installed? -Yes, Chrome Extension: How to detect if an extension is installed using Content Scripts

So maybe its possible to have a two-phase process:

-Your users will head to the web page, which will test for the extension (using #1 above)

-If its not there, have the users download and install the .exe (this will require interaction).

-The .exe will deploy the extension files and register it for Chrome (using #2 above)

-On subsequent visits, the already-installed extension can be used to launch/communicate with the now-already-installed .exe (using Native Messaging)

Community
  • 1
  • 1
FuzzyAmi
  • 7,543
  • 6
  • 45
  • 79