Exploring Windows Desktop Gadgets #2 – security and limitations

In this post (second in Exploring Windows Desktop Gadgets series) I’m going to dive deeper into Windows Desktop Gadgets platform and cover its security model and some limitations.

First of all, let me repeat that gadget is a client-side web-application running in chromeless mode on your desktop. It’s similar to HTA but provides a whole new set of functionality and also has some restrictions compared to HTA.

Gadgets security model

IE has always been the de-facto-standard platform for building powerful applications that require access to file system, Cryptographic Service Provider, WMI and other OS functionality. This functionality is achieved by using ActiveX controls. But ActiveX can’t run without a user permission! So by default javascript in web-applications has quite strong security limitations. This security model can only be weaken by users choice – by allowing ActiveX controls to run or by adding a website to a trusted zone.

But as gadgets are installed by user, so it’s his choice to run them, all functionality that MSHTML can provide is enabled (*). MSDN says:

The MSHTML runtime is configured with the set of permissions given to HTAs or the Local Machine Zone security configuration.

This rises a very important point – don’t install gadgets from non trusted sources. Or if you do, please inspect the code before you install the gadget. As Gadget runs under current user account, it won’t be able to delete system32 directory or do any other critical damage to the system. But it will surely succeed in deleting your documents or photos.

And of course, as any other Microsoft technology, Gadgets can be fully controlled by Group Policy.

For more information on Gadgets security please read this and this MSDN article.

Gadgets limitations

The main limitation to me is that there’re no modal dialogs. No alerts, no window.confirm, nothing. So if you want to do a quick debug, you have to dump data to the document itself or use a script debugger.

In one of the next posts on this topic I will cover debugging gadgets.

Share :