4

I'm currently performing file association when the program starts. This however requires elevated access and since I'm associating scripting files I feel like I'm doing something wrong that could compromise the security of the user. What is the correct way to do file association? Through a setup? Through the program? If the latter, how can I prevent malicious scripts to be executed through the program?

Christo S. Christov
  • 2,268
  • 3
  • 32
  • 57
  • 5
    I guess you should ask the user first with a UI (like most programs do when they install) and then ask for elevation. In the program itself, you could also have a menu that is capable of redoing it when the user feels it's needed. – Simon Mourier Oct 17 '16 at 10:02
  • 2
    Maybe this could be worth looking into: http://stackoverflow.com/questions/9705188/programmatically-add-file-association-without-admin-rights-in-c-sharp – FishySwede Oct 17 '16 at 11:42
  • You can register per-user associations which does not require elevation. System-wide associations are usually registered in installer. – Alexey Ivanov Oct 23 '16 at 20:33
  • I think all your answers are reasonable but I think I will accept @AlexeyIvanov 's answer. Thank you! – Christo S. Christov Oct 23 '16 at 22:02

1 Answers1

1

You can register per-user associations which does not require elevation.
System-wide associations are usually registered in installer.

System-wide associations are stored in HKLM\Software\Classes.
Per-user associations are stored in HKCU\Software\Classes.

The former is writable by Administrators only, the latter is usually writable by users¹.

The contents of these keys is merged into HKEY_CLASSES_ROOT.

¹ This is how, to some extent, Default Programs work: when you change your defaults, only per-user associations are changed so that different users can use different apps to open files.

For more information, see File Types and File Associations and Default Programs.

Alexey Ivanov
  • 11,541
  • 4
  • 39
  • 68