Page 1 of 1

Can JavaScript change registry entries?

Posted: Fri Jul 06, 2007 2:12 pm
by JellyFish
Or otherwise write to another's computer hard drive.

This doesn't sound believable. Ebay states it though:
Ebay wrote:
  • Not permitted
  • ...
  • HTML or JavaScript that changes registry entries, or otherwise writes to another's computer hard drive
  • ...
So it strikes my curiosity.

Posted: Fri Jul 06, 2007 2:18 pm
by superdezign
I believe IE prohibits it. I'm pretty sure that JavaScript does have the necessary functions, though.

Posted: Fri Jul 06, 2007 2:46 pm
by stereofrog
There are two standard ActiveX controls installed in Windows: WScript and FileSystemObject that provide access to registry and filesystem for javascript programs. Both are intended rather for shell scripting and disabled in browser by default.

Generally, the answer to "is something possible in language X" question is "everything is possible if you find a binding for your language". In case of javascript, that would be scriptable ActiveX or XPI component.

Posted: Fri Jul 06, 2007 2:58 pm
by alex.barylski
I think that statement made by eBay that you can tamper with the registry is slightly mis-leading. Using FSO anyways.

A quick look into FileSystemObject reveals no specialized API for working in the registry which is required as the registry is not a plain text file. You can work with native files and quite possibly change the registry that way, but to change it according to protocol (properly)...probably quite difficult.

Although using that object it's quite possible to f**k up files permenantly. That I've done! :P

Posted: Fri Jul 06, 2007 3:04 pm
by JellyFish
Could someone write a script to mess with my files on my comp without my permission?

Posted: Fri Jul 06, 2007 3:21 pm
by superdezign
JellyFish wrote:Could someone write a script to mess with my files on my comp without my permission?
Browsers don't allow it. If any did, no one would use it.

Edit: Microsoft allows it for their website, however. I'm not sure if they do so through JavaScript, but they have unlimited access to your OS (if it's Windows).

Posted: Fri Jul 06, 2007 3:47 pm
by stereofrog
JellyFish wrote:Could someone write a script to mess with my files on my comp without my permission?
If you allow ActiveX (especially the ones marked as "not safe for scripting") to be installed and executed, that's quite possible.

Posted: Fri Jul 06, 2007 3:49 pm
by stereofrog
Hockey wrote: A quick look into FileSystemObject reveals no specialized API for working in the registry
Correct. The registry can be accessed with WScript.Shell object.

Posted: Fri Jul 06, 2007 5:12 pm
by alex.barylski
Hmmm...coool...I wasn't aware of that ability. That could come in handy when developing corporate management systems which are used in Intranet's.

Posted: Fri Jul 06, 2007 5:20 pm
by JellyFish
Bottom line is no one can hack into your computer unless you give them permission (i.e. use the a crappy browser that is acts no better then a malware program)?

Or are there ways of hacking into any computer without a security program?

Posted: Fri Jul 06, 2007 6:12 pm
by stereofrog
JellyFish wrote: Or are there ways of hacking into any computer without a security program?
Unfortunately, yes. Every software, including browsers, mail clients, firewalls and operating systems contains security holes, and an experienced hacker can gain access to everything. There's no door that cannot be opened. ;(

Posted: Fri Jul 06, 2007 6:24 pm
by JellyFish
stereofrog wrote:
JellyFish wrote: Or are there ways of hacking into any computer without a security program?
Unfortunately, yes. Every software, including browsers, mail clients, firewalls and operating systems contains security holes, and an experienced hacker can gain access to everything. There's no door that cannot be opened. ;(
How is this possible?

Posted: Fri Jul 06, 2007 9:26 pm
by feyd
JellyFish wrote:How is this possible?
All software contains bugs.