JavaScrip, xml and Linux

[Jean Pion]

Dear readers,

Can I use the following object on a Linux based web server:

var xmlDoc = new ActiveXObject("Microsoft.XMLDOM");

If not, is there a compatible object?

Tia, Jean.

 

[Jean Pion]

Dear readers,

Okay, that was a bit stupid because the object is - ofcourse - created by
the browser...
Now the real trouble is the following code:

var xmlDoc = new ActiveXObject("Microsoft.XMLDOM");
xmlDoc.async = "false";
xmlDoc.load(http://111.222.333.444/btw/Btw2Xml.jsp?parm=NYC);

If I have a local file, I can do the load... ( the url shown is a fake one)

If I put very same file on my webserver, I get a an "access error" in IE on
the 3rd line show, character 7.
This is the 'dot' in "xmlDoc.load". If I use the script debugger it says:
"msxml3.dll : access denied".

Which is very informative, but not a great help.
Does anyone have a clue?

Tia, Jean.

 

[Martin Honnen]

Jean Pion wrote:

Now the real trouble is the following code:

var xmlDoc = new ActiveXObject("Microsoft.XMLDOM");
xmlDoc.async = "false";

Should be
xmlDoc.async = false;

xmlDoc.load(http://111.222.333.444/btw/Btw2Xml.jsp?parm=NYC);

If I have a local file, I can do the load... ( the url shown is a fake one)

If I put very same file on my webserver, I get a an "access error" in IE on
the 3rd line show, character 7.

If you have script in a page served from http://example.com/ then using
Microsoft.XMLDOM you can only load URLs from that host
http://example.com/, at least with the normal security settings in IE.
I think you can make http://example.com/ a trusted site and thereby
allow it to connect to other servers.

 

[Jean Pion]

Thanks Martin,

That sounds very reasonable...
I tried this, but I still have the same troubles.
Even checked all the options for trusted sites, which seem to allow for
cross-domain activities.

Now trough yout link found that:

Set the domain property only if you must allow cross-domain scripting. Use a
value determined on the server. Setting this property to a value determined
on the client (like through the location object) could expose your site to
attack from another site through Domain Name System (DNS) manipulation.

But I'm unsure what it means but I think it is releated.
Any examples?

Tia, Jean.

 

[Jean Pion]

Thanks Martin,

Oh dear, oh dear. In my hury I 'trusted' the the wrong site.
So, to follow your example:

If you have script in a page served from http://www.example.com then using
Microsoft.XMLDOM you can load URLs from http://www.elsewhere.com
if you can make http://www.example.com a trusted site.

You were right, thank you.
I was confused and tried to 'trust' http://www.elsewhere.com but that does
not work.

Jean

Thanks Martin,

That sounds very reasonable...
I tried this, but I still have the same troubles.
Even checked all the options for trusted sites, which seem to allow for
cross-domain activities.

Now trough yout link found that:

Set the domain property only if you must allow cross-domain scripting. Use a
value determined on the server. Setting this property to a value determined
on the client (like through the location object) could expose your site to
attack from another site through Domain Name System (DNS) manipulation.

But I'm unsure what it means but I think it is releated.
Any examples?

Tia, Jean.

Jean Pion wrote:



Should be
xmlDoc.async = false;

IE

 

[Mark Preston]

Dear readers,

Can I use the following object on a Linux based web server:

var xmlDoc = new ActiveXObject("Microsoft.XMLDOM");

If not, is there a compatible object?

Jean,

I see you already have a few answers, but not about the actual problem.
As a test, can you imagine where a Linux system would get hold of either
ActiveXObjects or Microsoft.XMLDOM?

That's right - neither can I. Both are, after all, _Microsoft_ products
which are in notoriously short supply on Linux systems...