PRB: UseSafeSubset Allows Non-safe Objects to Be Called

MORE INFORMATION

Microsoft provides programming examples for illustration only, without warranty either expressed or implied, including, but not limited to, the implied warranties of merchantability and/or fitness for a particular purpose. This article assumes that you are familiar with the programming language being demonstrated and the tools used to create and debug procedures.

Steps to Reproduce Behavior

1. In Visual Basic create a new project and add the following component:

         Microsoft Script Control 1.0
   						

2. Add the Script control (ScriptControl1), a text box (Text1), and a command button (Command1) to a form. In Visual Basic, set the MultiLine property of the text box to TRUE. For ease of use change the size of Text1 so that it will accommodate 5 lines of 60 characters.
3. Add the following code:

         Private Sub Command1_Click()
           On Error Resume Next
           With ScriptControl1
             .UseSafeSubset = True
             .Language = "VBScript"
             .AllowUI = True
             .AddCode Text1.Text
             .Run "Test"
           End With
         End Sub
   						

4. Run the form and open the Debug window.
5. Type the following script into the text box. If you do not have Microsoft Excel, use a different server application.

         Sub Test()
         Dim X
           Set X = CreateObject("Excel.Application")
           X.Visible = True     ' this line is Excel-specific
           MsgBox "Pausing for effect...."
           Set X = Nothing
         End Sub
   						

6. Click the command button. Microsoft Excel is displayed.
7. Click OK on the message box and Excel will close.
8. Install version 6.0 of the control and re-run. You will get a trappable error indicating that the object is not marked safe for scripting:
   Run-time error '429':
   ActiveX component can't create object 'createobject'

(c) Microsoft Corporation 1998, All Rights Reserved. Contributions by Malcolm Stewart, Microsoft Corporation