Execute a batch script from Firefox - security

I have written an intranet application from which you can directly connect to a virtual machine by clicking on a RDP-button. The click calls a .bat file, which opens the connection.
With IE, this is no problem, as you can choose to directly execute the batch file. But with Firefox, I can only download the script, and have to start it manually afterwards. Is there a way to trust the intranet domain (about:config?) so Firefox allows it to execute scripts directly? Or is there an even better (easier) way to start an RDP connection from Firefox?

You can easily register a custom protocol handler such as "myrdp://somedata" to run the app that opens the VM (This would probably work with a .bat, it works with a WSH script, better a small exe)
IE/FF support this functionality and allow you to then simply <a href="myrdp://somedata" ..>

You could also try to set up your firefox to automatically open the .rdp files with the default rdp client. This way the files will be downloaded in a temp dir and immediately started up.
You can do this in Firefox's preferences. Hope this helps )

Related

How To ADD Firefox Default Applications

So I'm trying to find a way to add default file extensions options to Firefox. Since for whatever reason it doesn't give you the option?
Example: Settings > General > Applications
I want to add new content types and then be able to select my default application of choice.
The current issue is, that I use an MSP client that when necessary allows us to remote into a client's workstation for troubleshooting. Normally one would just click on the "Start Remote Session," button, and it brings up the application to do so. However, since it operates in some form of Javascript (I think....?), it doesn't technically download a file for me to save and then execute through the app. It just opens the app automatically. It never gives me the option to save the a file or anything like that, that it would use for the Remote Session app.
So I want to figure out how to bypass this issue by just adding the extension needed for this process in Firefox's default content types.
Works on Windows, I'm currently on Linux. (So please don't tell me to not use linux or any form there of. That or to use wine or playonlinux. I already am)

Execute a shell (script) from Chromium?

Is there a way to launch a bash/ksh shell, or execute a shell script from Chromium? Is there a setting to tweak, a plungin to add, a workaround besides php and a local server?
Sorry if this is a duplicate. I assumed I would find an answer here, but only see answers about launching Chromium using a script or complete workarounds avoiding my question, with a local server and JavaScript/PHP. I have an Apache server available and can do the coding, but rather not.
I could do this in Internet Explorer on Windows (or used to be able to launch a .bat script there. I haven't used IE in a long time), why not in Chromium on Linux?
I understand the security concerns and sandbox in the browser, but in this case the browser never goes outside a firewall and I just want to launch a script from Chromium.
Thank you for your thoughtful replies.

Launch a local file with default file handler from chrome packaged app (or extension)

I'm building a launcher for internal use with a Chrome packaged app which includes links to internal resources (databases, web links, etc.).
The problem is with local files. I want them to launch using whatever program is the default handler for them. For example, access databases open in Access, etc.
I've tried:
Creating a file link file:///. Nothing happens in this scenario on click and the link is not followed.
I found an extension (locallinks) here: https://code.google.com/p/locallinks/, which will open local file links. I've tried borrowing from that extension and passing the file link to the background script in my packaged app which would then open a new window with that url. Unfortunately, that results in a file not found, even for simple types such as text files. So obviously the local filesystem is sandboxed. Not surprising.
I thought maybe it would work to pass the link to an extension to open, but in that case, the file would be opened in Chrome and if Chrome does not support it, it would attempt to download the file locally.
The reason I'm using Chrome Packaged Apps is:
1. This will be updated often and the Chrome Web Store update feature would make it easy to keep clients updated without having to build our own update mechanism.
2. We can restrict installation of the app through CWS to internal users.
3. The app would be used in a Windows, Linux and Mac environment. Obviously the file paths here would be different but since they would point to a samba share, and mount points and network share drive's are known this is an easy problem to overcome.
4. There is additional functionality we will be building into the Chrome app in the future other than the launcher which fits very well with how Chrome Apps are designed.
My thoughts are:
Native Client? I have read a bit about these, but I think I would end up with the same limitations where the native client app would be sandboxed and may not actually have any better way of launching a local file.
Sockets? Maybe a simple Qt app listening on a socket to launch apps? Since the Qt app would be run with user permissions, and the socket would only accept connections from localhost, I guess the socket could in theory be used by a non-privileged app to launch something with user-level permissions. Is there a way for me to limit connections through the socket to only be accessible from my extension?
The sockets solution isn't ideal but may work since the app would not be updated often (if ever) since functionality is so simple.
Am I missing an obvious way of doing this that wouldn't require another component (a Qt app?)
Relating to your thought #2, not sure what local installation footprint you are willing to tolerate, but you may consider:
Hosting a miniscule local web server, or Qt app as you mention, which can also launch local programs (any of those lightweight web server frameworks). Have your packaged app, or your own chrome extension rewrite links such that they point at your web server along with the url of the original link, which can easily launch whatever program. Downsides: this may cause bypassing some browser security screening of the original links in some forms of implementation.
You may also look at this stackoverflow question if it helps.
You can limit access by confirming the requests originate from the local machine, or by embedding a key or hash inside your chrome extension. You may generate the key upon installation so that it's unique per machine. None of this will pass very proper security scrutiny so it depends on your risk profile. You will have a hard time justifying how each part is secure and clean of exploitation attack potential.
It seems you will need both a chrome extension and a local miniscule web server to make this work. Maybe it's easier to let users just download the files and click them...
Sorry if this isn't help enough, but basically you are trying to do something that is by design not made possible in Chrome, so at this state of affairs there would likely not be a simple solution.

How to install browser extension from my program

I want to bundle an extension with my executable, and I want it to automatically add it to the users browser if they have chrome or firefox. Is there a directory where I can drop the .crx file containing the extension for chrome, and chrome will automatically use it? And what should I do for firefox?
If you want to simplify things you can use Crossrider and get an installer which will install your extension on IE, Firefox and Chrome.
This installer can also run in silent mode, so you run it from your executable without interrupting the normal flow.
To do all that, you will first have to open a new user and copy your extension code to Crossrider (which is probably a good idea anyway since then you will have one code for your app which will support all browsers).
For Chrome:
You can put it in the registry or drop it in the external-extensions.json file (%localappdata%/Google/Chrome/Application/chrome_xx.xxx.xxx.xxx/Extensions/).
I never did it myself actually but it's all documented on the official channel:
http://code.google.com/chrome/extensions/external_extensions.html
There's also a way to install it via Group-Policy, but none of all these three methods is cross-platform AFAIK.
For Firefox:
I have no idea.
My recommendation would be:
DO go through the browser itself,
DO NOT try to sneak around and force it onto the user
Reasons for this are:
the browser is meant to ask for the user's permission, clearly and explicitly.
that's the only cross-platform way I know (and it already requires forking out, so that's not even that totally cross-platform).
I'd simply recommend forking out a browser and passing as argument the extension's file or download URL, so that it will automatically request the user's permission and start the installation process.
For instance, just calling this (on linux, if google-chrome is on your PATH):
google-chrome PATH_TO_FOLDER_OR_URL_PREFIX/myextension.xpi
Or:
google-chrome PATH_TO_FOLDER_OR_URL_PREFIX/myextension.crx
Or for Firefox:
firefox PATH_TO_FOLDER_OR_URL_PREFIX/myextension.xpi

Launching a web page in a different process

I want to launch the browser in a different process when a particular link is clicked on the page. When I checked the net I found the following tip: http://www.dslreports.com/faq/3849 . But there we have to change the registry. Is there any simple way of doing this without touching the registry?
If you use the Google Chrome browser, each new window or tab runs in a separate process. Internet Explorer version 8 will do the same (it's currently in the second beta round).
Earlier versions of IE will run a new window in a separate process if it is launched from, say, the Start menu or the command line, or a link in an email (but not by clicking a link within IE). I imagine you could create a proxy that the client would run through, which would intercept the links you care about and launch them by running a command line request. That seems like more trouble than mucking with the registry though (assuming that registry change still works -- looks like your link is from 2002).
I don't believe this is possible unless you change the client computer setup or software it's running.
Why do you want to do this?

Resources