I've set up a simple testbed for WatiN (ver 2.1) which reads:

var browser = new IE();

browser.GoTo(""); // webpage doesn't matter really
browser.RunScript("alert(123)");

This works only if KB3025390 is not installed. Installing it breaks the above test with an UnAuthorizedAccessException which has HRESULT set to E_ACCESSDENIED. What gives? Is there any workaround?

Update: Using IWebBrowser2.Navigate2 along with "javascript:console.log(123)" type of scripts works however

• it makes me feel uneasy using such a backchannel
• the scripts run through this back-channel of .Navigate2() may only have a max length of about 2070 chars (give or take) otherwise they get forcibly truncated to this length leading to javascript errors upon attempting to run them
• using .Navigate2(), even with the most trivial script, will clog the ready state of Internet Explorer for good in the sense that it will be set to READYSTATE_LOADING without any hope of getting rid of it. In simple terms this means that once you use this hack, you either have to perform every single subsequent operation in WatiN in a "dont-wait-for-webpage-to-load" fashion (GoToNoWait, ClickNoWait etc) lest your code freezes upon waiting for the browser to turn back to READYSTATE_COMPLETE (which will never e about ofcourse as already mentioned).
• there appears to be a much broader issue here in the sense that I can't even access the properties of an IHtmlWindow2 object p.e. window.document throws an unauthorized exception again making it virtually impossible to transfer over to the C# world the return-values of the scripts I'm running (using Expando etc) for documents other than window.top.document (for the window.top.document window there is IWebBrowser2.Document which does the trick)

Update#2: The folks over at the selenium project have also noticed this issue:

A bug report has been created as well:

Update#3: IHTMLWindow2.setInterval and IHTMLWindow2.setTimeout also throw UnauthorizedAccess exceptions. These methods are not marked as deprecated in:

.85%29.aspx

yet they have wounded up suffering from the same cutbacks all the same.

Update#4: I gave the approach remended in this post a shot:

In order to dynamically invoke the "eval" method of the IHTMLWindow2 object (or any other method really). Got the same "System.UnauthorizedAccessException" as above. So no joy here either.

Microsoft remends using "eval" over "execscript" however after the above experiment I suspect that they are refering to accessing "eval" only from within the browser.

As far as I can tell thus far, when it es to the full-fledged IE11+ using "eval" out-of-process (via COM) appears to have been pletely prohibited along with any other function-invocation of the window object, the only exception being the back-channel of the .Navigate2() mentioned above.

I've set up a simple testbed for WatiN (ver 2.1) which reads:

var browser = new IE();

browser.GoTo("http://www.google.co.il"); // webpage doesn't matter really
browser.RunScript("alert(123)");

This works only if KB3025390 is not installed. Installing it breaks the above test with an UnAuthorizedAccessException which has HRESULT set to E_ACCESSDENIED. What gives? Is there any workaround?

Update: Using IWebBrowser2.Navigate2 along with "javascript:console.log(123)" type of scripts works however

• it makes me feel uneasy using such a backchannel
• the scripts run through this back-channel of .Navigate2() may only have a max length of about 2070 chars (give or take) otherwise they get forcibly truncated to this length leading to javascript errors upon attempting to run them
• using .Navigate2(), even with the most trivial script, will clog the ready state of Internet Explorer for good in the sense that it will be set to READYSTATE_LOADING without any hope of getting rid of it. In simple terms this means that once you use this hack, you either have to perform every single subsequent operation in WatiN in a "dont-wait-for-webpage-to-load" fashion (GoToNoWait, ClickNoWait etc) lest your code freezes upon waiting for the browser to turn back to READYSTATE_COMPLETE (which will never e about ofcourse as already mentioned).
• there appears to be a much broader issue here in the sense that I can't even access the properties of an IHtmlWindow2 object p.e. window.document throws an unauthorized exception again making it virtually impossible to transfer over to the C# world the return-values of the scripts I'm running (using Expando etc) for documents other than window.top.document (for the window.top.document window there is IWebBrowser2.Document which does the trick)

Update#2: The folks over at the selenium project have also noticed this issue:

https://code.google./p/selenium/issues/detail?id=8302

A bug report has been created as well:

https://connect.microsoft./IE/feedback/details/1062093/installation-of-kb3025390-breaks-out-of-process-javascript-execution-in-ie11

Update#3: IHTMLWindow2.setInterval and IHTMLWindow2.setTimeout also throw UnauthorizedAccess exceptions. These methods are not marked as deprecated in:

http://msdn.microsoft./ko-kr/library/windows/desktop/aa741505%28v=vs.85%29.aspx

yet they have wounded up suffering from the same cutbacks all the same.

Update#4: I gave the approach remended in this post a shot:

https://stackoverflow./a/18546866/863651

In order to dynamically invoke the "eval" method of the IHTMLWindow2 object (or any other method really). Got the same "System.UnauthorizedAccessException" as above. So no joy here either.

Microsoft remends using "eval" over "execscript" however after the above experiment I suspect that they are refering to accessing "eval" only from within the browser.

As far as I can tell thus far, when it es to the full-fledged IE11+ using "eval" out-of-process (via COM) appears to have been pletely prohibited along with any other function-invocation of the window object, the only exception being the back-channel of the .Navigate2() mentioned above.

• javascript
• security
• watin

Share Improve this question Follow edited Jul 6, 2020 at 17:29 Martijn Pieters 1.1m321321 gold badges4.2k4.2k silver badges3.4k3.4k bronze badges asked Dec 19, 2014 at 13:17 XDSXDS 4,23544 gold badges4242 silver badges6868 bronze badges 8

• What about browser.Eval("alert(123)");? – Greg Burghardt Commented Dec 19, 2014 at 13:38
• I'm also wondering if browser.GoTo("javascript:alert(123)") would work as well. Maybe it's got something with how the alert is being called? – Greg Burghardt Commented Dec 19, 2014 at 13:41
• .Eval() fails with the same HRESULT. The .GoTo() approach seems to work though at least on trivial tests. On a different note: I fiddled with the security settings of IE in the Internet Zone and nothing came out of it. Thanks for looking into this. – XDS Commented Dec 19, 2014 at 15:38
• Another thing I noticed is that browser.Eval() of WatiN essentially falls back internally to using window.execScript() like browser.ExecScript() and this is why it makes no difference at the end of the day. Read update#4 on how to invoke the "real" eval of the window object (only to still fail though). – XDS Commented Dec 22, 2014 at 18:12
• I think your only solution is to remove the update that broke this. Which version of Visual Studio are you using? Maybe an update to VS will fix this? – Greg Burghardt Commented Dec 22, 2014 at 18:21

 |  Show 3 more ments

3 Answers 3

Sorted by: Reset to default 3

It turns out Microsoft eventually backpedaled on its decision to kill off .execScript at COM-level. Just install the latest updates for Windows including kb3025390: One of the updates for IE that came after kb3025390 brings back .execScript functionality at COM-level

Note, however, that .execScript is not accessible through IE's javascript anymore. In that context it's gone for good.

fyi: this one is also not working

ieInstance.Document.Script.<methodNameString>(<maSeperatedParameterString>)

try this worked for me at some places but not all places

ieObject.Navigate "javascript:<methodNameString>(<maSeperatedParameterString>)", Null, "_parent"

or

ieObject.Navigate2 "javascript:"<methodNameString>(<maSeperatedParameterString>)", Null, "_parent"

now trying to find out solution using eval

I have found a way around the problem of an update installing automatically. You can just create a simple batch file with following content.

{code} @echo off

wusa /uninstall /kb:3025390/quiet /norestart

END {code}

Then go to task scheduler, create a new task for this batch file to run every one hour or day as per your requirements. Add it as a system task so it runs in the background and does not affect the running automations.