開發ActiveX控制元件過程中遇到這樣的問題：

本機上開發完成後，用TstCon測試介面沒問題。js寫靜態頁面測試呼叫沒問題。但是給到web端開發，他們使用內網IP或者外網地址時，會報錯。如圖：

開始以為是IE本地設定的問題，把對ActiveX限制的都改為允許，但是試了之後還是不行。後來聯想到是否是因為本地除錯IE用的Intranet策略，而以IP方式訪問IE採用的是Internet策略。所以果斷去設定Internet選項，如圖，。

點開自定義級別，

把上圖中『對未標記為可安全執行指令碼的ActiveX控制元件初始化並執行指令碼』改為啟用後，發現有的機器可以，有的不成，而且設定後IE會提示不安全之類的。看起來很不優雅。果斷放棄修改IE設定。

仔細想想，自己寫的跟官方提供的一些控制元件理論上除了沒有數字簽名外，應該沒別的不同，於是嘗試增加數字簽名，當然這個是沒有認證的。嘗試後這個方案也失敗了。

找資料看到這樣一篇文章：http://www.xuebuyuan.com/758961.html

裡面講到，在IE的中級安全設定上，是允許指令碼安全的ActiveX建立並且不予警告的。那麼IE怎麼知道一個外掛式指令碼安全的呢？

①通過查詢ActiveX是否實現了IObjectSafety介面，並且返回指令碼安全；

②查詢ActiveX是否在登錄檔Component Category Manager裡表明自己實現了 CATID_SafeForInitializing 和 CATID_SafeForScripting。此方法修改DllRegisterServer函式

所以，問題的關鍵是我們自己的ActiveX控制元件 實現CATID_SafeForInitializing 和 CATID_SafeForScripting，以及IObjectSafety介面。

那就來吧。

①實現CATID_SafeForInitializing  和 CATID_Safeforscripting

XXX.h中宣告（以下XXX代表你的工程名，比如MyActiveX，則XXX.h表示MyActiveX.h）

包含標頭檔案檔案  #include "comcat.h"

HRESULT CreateComponentCategory(CATID catid, WCHAR* catDescription);
HRESULT RegisterCLSIDInCategory(REFCLSID clsid, CATID catid);
 

①xxxCtrl.h中宣告：

//ObjSafe
	DECLARE_INTERFACE_MAP()

	BEGIN_INTERFACE_PART(ObjSafe, IObjectSafety)
	STDMETHOD_(HRESULT, GetInterfaceSafetyOptions)   (
		/*   [in]   */   REFIID   riid,
		/*   [out]   */   DWORD   __RPC_FAR   *pdwSupportedOptions,
		/*   [out]   */   DWORD   __RPC_FAR   *pdwEnabledOptions
	);

	STDMETHOD_(HRESULT, SetInterfaceSafetyOptions)   (
		/*   [in]   */   REFIID   riid,
		/*   [in]   */   DWORD   dwOptionSetMask,
		/*   [in]   */   DWORD   dwEnabledOptions
	);
	END_INTERFACE_PART(ObjSafe);

const CATID CATID_SafeForScripting =
{ 0x7dd95801, 0x9882, 0x11cf, { 0x9f, 0xa9, 0x00, 0xaa, 0x00, 0x6c, 0x42, 0xc4 } };
const CATID CATID_SafeForInitializing =
{ 0x7dd95802, 0x9882, 0x11cf, { 0x9f, 0xa9, 0x00, 0xaa, 0x00, 0x6c, 0x42, 0xc4 } };

// 建立元件種類     
HRESULT CreateComponentCategory(CATID catid, WCHAR* catDescription)
{
	ICatRegister* pcr = NULL;
	HRESULT hr = S_OK;
	hr = CoCreateInstance(CLSID_StdComponentCategoriesMgr, NULL, CLSCTX_INPROC_SERVER, IID_ICatRegister, (void**)&pcr);
	if (FAILED(hr)) return hr;
	// Make sure the HKCR\Component Categories\{..catid...}      
	// key is registered.      
	CATEGORYINFO catinfo;
	catinfo.catid = catid;
	catinfo.lcid = 0x0409; // english      
	// Make sure the provided description is not too long.      
	// Only copy the first 127 characters if it is.      
	int len = wcslen(catDescription);
	if (len>127) len = 127;
	wcsncpy(catinfo.szDescription, catDescription, len);
	// Make sure the description is null terminated.      
	catinfo.szDescription[len] = '\0';
	hr = pcr->RegisterCategories(1, &catinfo);
	pcr->Release();
	return hr;
}

// 註冊元件種類     
HRESULT RegisterCLSIDInCategory(REFCLSID clsid, CATID catid)
{
	// Register your component categories information.      
	ICatRegister* pcr = NULL;
	HRESULT hr = S_OK;
	hr = CoCreateInstance(CLSID_StdComponentCategoriesMgr, NULL, CLSCTX_INPROC_SERVER, IID_ICatRegister, (void**)&pcr);
	if (SUCCEEDED(hr)) {
		// Register this category as being "implemented" by the class.      
		CATID rgcatid[1];
		rgcatid[0] = catid;
		hr = pcr->RegisterClassImplCategories(clsid, 1, rgcatid);
	}
	if (pcr != NULL) pcr->Release();
	return hr;
}

// 標記控制元件初始化安全.      
	// 建立初始化安全元件種類     
	HRESULT hr = CreateComponentCategory(CATID_SafeForInitializing, L"Controls safely initializable from persistent data!");
	if (FAILED(hr)) return hr;
	// 註冊初始化安全     
	hr = RegisterCLSIDInCategory(BASED_CODE _tlid, CATID_SafeForInitializing);
	if (FAILED(hr)) return hr;
	// 標記控制元件指令碼安全     
	// 建立指令碼安全元件種類     
	hr = CreateComponentCategory(CATID_SafeForScripting, L"Controls safely scriptable!");
	if (FAILED(hr)) return hr;
	// 註冊指令碼安全元件種類     
	hr = RegisterCLSIDInCategory(BASED_CODE _tlid, CATID_SafeForScripting);
	if (FAILED(hr)) return hr;

// 刪除控制元件初始化安全入口. 
HRESULT hr = UnRegisterCLSIDInCategory(BASED_CODE _tlid, CATID_SafeForInitializing);
	if (FAILED(hr)) return hr;
	// 刪除控制元件指令碼安全入口     
	hr = UnRegisterCLSIDInCategory(BASED_CODE _tlid, CATID_SafeForScripting);
	if (FAILED(hr)) return hr;

xxxCtrl.h中新增：

//ObjSafe
	DECLARE_INTERFACE_MAP()

	BEGIN_INTERFACE_PART(ObjSafe, IObjectSafety)
	STDMETHOD_(HRESULT, GetInterfaceSafetyOptions)   (
		/*   [in]   */   REFIID   riid,
		/*   [out]   */   DWORD   __RPC_FAR   *pdwSupportedOptions,
		/*   [out]   */   DWORD   __RPC_FAR   *pdwEnabledOptions
	);

	STDMETHOD_(HRESULT, SetInterfaceSafetyOptions)   (
		/*   [in]   */   REFIID   riid,
		/*   [in]   */   DWORD   dwOptionSetMask,
		/*   [in]   */   DWORD   dwEnabledOptions
	);
	END_INTERFACE_PART(ObjSafe);

//介面對映
BEGIN_INTERFACE_MAP(CRtmpDumpCtrlCtrl, COleControl)
	INTERFACE_PART(CRtmpDumpCtrlCtrl, IID_IObjectSafety, ObjSafe)
END_INTERFACE_MAP()

ULONG FAR EXPORT CRtmpDumpCtrlCtrl::XObjSafe::AddRef()
{
	METHOD_PROLOGUE(CRtmpDumpCtrlCtrl, ObjSafe)
	return pThis->ExternalAddRef();
}

ULONG FAR EXPORT CRtmpDumpCtrlCtrl::XObjSafe::Release()
{
	METHOD_PROLOGUE(CRtmpDumpCtrlCtrl, ObjSafe)
		return pThis->ExternalRelease();
}

HRESULT FAR EXPORT CRtmpDumpCtrlCtrl::XObjSafe::QueryInterface(REFIID iid, void FAR* FAR* ppvObj)
{
	METHOD_PROLOGUE(CRtmpDumpCtrlCtrl, ObjSafe)
	return (HRESULT)pThis->ExternalQueryInterface(&iid, ppvObj);
}

const DWORD dwSupportedBits = INTERFACESAFE_FOR_UNTRUSTED_CALLER | INTERFACESAFE_FOR_UNTRUSTED_DATA;
const DWORD dwNotSupportedBits = ~dwSupportedBits;

HRESULT   STDMETHODCALLTYPE
CRtmpDumpCtrlCtrl::XObjSafe::GetInterfaceSafetyOptions(
/* [in] */ REFIID riid,
/* [out] */ DWORD __RPC_FAR *pdwSupportedOptions,
/* [out] */ DWORD __RPC_FAR *pdwEnabledOptions)
{
	METHOD_PROLOGUE(CRtmpDumpCtrlCtrl, ObjSafe)
	HRESULT retval = ResultFromScode(S_OK);
	// does interface exist?   
	IUnknown FAR* punkInterface;
	retval = pThis->ExternalQueryInterface(&riid, (void **)&punkInterface);
	if (retval != E_NOINTERFACE)
	{ // interface exists   
		punkInterface->Release(); // release it--just checking!   
	}
	// we support both kinds of safety and have always both set, regardless of interface   
	*pdwSupportedOptions = *pdwEnabledOptions = dwSupportedBits;
	return retval; // E_NOINTERFACE if QI failed   
}

HRESULT STDMETHODCALLTYPE
CRtmpDumpCtrlCtrl::XObjSafe::SetInterfaceSafetyOptions(
/* [in] */ REFIID riid,
/* [in] */ DWORD dwOptionSetMask,
/* [in] */ DWORD dwEnabledOptions)
{
	METHOD_PROLOGUE(CRtmpDumpCtrlCtrl, ObjSafe)
		// does interface exist? 
	IUnknown FAR* punkInterface;
	pThis->ExternalQueryInterface(&riid, (void**)&punkInterface);
	if (punkInterface)
	{ // interface exists 
		punkInterface->Release(); // release it--just checking! 
	}
	else
	{ // interface doesn't exist 
		return ResultFromScode(E_NOINTERFACE);
	}

	// can't set bits we don't support 
	if (dwOptionSetMask & dwNotSupportedBits)
	{
		return ResultFromScode(E_FAIL);
	}

	// can't set bits we do support to zero 
	dwEnabledOptions &= dwSupportedBits;
	// (we already know there are no extra bits   in   mask   )   
	if ((dwOptionSetMask&dwEnabledOptions) != dwOptionSetMask)
	{
		return ResultFromScode(E_FAIL);
	}
	//don't need to change anything since we're always safe 
	return ResultFromScode(S_OK);
}

https://support.microsoft.com/zh-cn/kb/161873

https://msdn.microsoft.com/zh-cn/library/aa751977(v=vs.85).aspx

http://blog.sina.com.cn/s/blog_4f9fc08e01014ipt.html

http://www.xuebuyuan.com/758961.html

http://blog.csdn.net/aasmfox/article/details/38616997

烏雲的兩篇好文：

http://drops.wooyun.org/papers/5673

http://drops.wooyun.org/papers/7521