ActiveX

From MozillaZine Knowledge Base
Revision as of 13:24, 14 October 2006 by Alice Wyman (talk | contribs) (added links and minor edits to Intro, moved "Warning" under "ActiveX plugin" section.)
Jump to navigationJump to search

ActiveX is the system Internet Explorer uses in place of the NPAPI system that all other browsers use, to embed other applications inside themselves. While both systems have similar functionality, NPAPI plug-ins are just for browser use and ActiveX Controls can be used to embed many other Windows applications in each other. In addition, NPAPI plug-ins were designed for cross-platform use and ActiveX is restricted to Windows.

While Internet Explorer will use ActiveX to render all embedded content, content that explicitly specifies the use of an ActiveX control will not render in a browser without ActiveX support. For this reason, a third-party ActiveX plugin that adds partial ActiveX support to some Mozilla-based browsers has been created.

Security

It is generally believed that ActiveX is inherently insecure compared to the NPAPI plug-in system, but this is only partially true. ActiveX controls and plug-ins have all the same powers over the computer as each other, so a malicious plug-in can do just as much damage as an ActiveX control. But by the way ActiveX is implemented in Internet Explorer (and its use in many other Microsoft applications), it is easier to get a malicious ActiveX Control onto a user's computer and to get it to run. A detailed explanation can be found here: http://en.wikipedia.org/wiki/NPAPI#Security

ActiveX plugin

Warning - If you have the Adblock extension with the OBJ-TABS setting enabled, the ActiveX plugin will ignore its configuration and run any installed ActiveX control - this is a security risk. 1 2

Microsoft Windows

Mozilla does not support ActiveX controls natively. However, a plugin for ActiveX controls support is available. In its default security configuration (as specified in the file activex.js, located in the defaults\pref subfolder of the browser's installation directory), it will not download or install controls itself, and it will only host controls that are already installed into Windows and marked safe for scripting. For the Firefox versions, the plug-ins default security configuration is to only host the two Windows Media player controls. Information on the use of the plug-in for Windows Media can be found here: Windows Media Player - ActiveX plugin.

You must ensure that, if you intend to install the ActiveX plugin, you get the correct version for your version of Mozilla Suite/Firefox. Each version of the plug-in is only compatible with a small range of Mozilla Suite/Firefox versions. If you have the wrong version of ActiveX, it has been known to disable/interfere with Flash content, and there is no guarantee that the plug-in will obey its security configuration.

To avoid compatibility issues, you should also uninstall the ActiveX plugin or, at the minimum, remove the plugin file "npmozax.dll" from the browser's installation directory\plugins folder when upgrading your browser to a newer version.

Linux (x86)

Recent versions of CrossOver Office ship with the Mozilla ActiveX plugin, but don't expect it to work as well as it would on Windows.

See also