News

Purpose

FFClickOnce lets you run .NET ClickOnce applications from Firefox.

ClickOnce applications are launched from a link to a ".application" file. When a user clicks on this kind of link, Firefox downloads the file to a temporary directory and runs it locally. This causes the ClickOnce launch process to fail.

This problem is documented on several websites:

• http://www.hanselman.com/blog/ClickOnceAndFireFoxWithACustomSetupEqualsClickThriceAndBeDisappointed.aspx
• http://channel9.msdn.com/ShowPost.aspx?PostID=138273

Solution

FFClickOnce is a Firefox extension that adds an extra option when you click on a link to a ClickOnce application, as in the following pictures:

The dialog that appears in Firefox versions 2.0 and earlier

The dialog that appears in Firefox versions 2.0.0.1 and later.

I realize that, with this method, users have to click more than once to run their "ClickOnce" software, but I feel very uneasy about the security implications of being able to instantly run software downloaded from the web. I feel that users should be informed that the link they have clicked on is a ClickOnce link, and that they should be given an option to cancel the operation, if they wish. The present scheme accomplishes that.

Installation

FFClickOnce v0.6 is available on the FFClickOnce page at the Mozilla Addons Site. This is the recommended way of getting FFClickOnce.

After installation, as a quick check to make sure that it works, try the sample ClickOnce application at http://www.softwarepunk.com/clickonce/tester/deploy/publish.htm

For more comprehensive information, I have created a testing document for FFClickOnce. It is primarily intended for people testing the extension, though I believe that a user could read it and get a good idea of how to use this extension.

Implementation Details

When you use FFClickOnce to run a ClickOnce application, it takes the URL and executes the following command:

%SystemRoot%\system32\rundll32.exe dfshim.dll,ShOpenVerbApplication The_URL_goes_here

Version 0.3 of FFClickOnce also tries to figure out which versions of the .NET Framework are installed on your computer. It does this by following the advice in http://support.microsoft.com/kb/318785, which tells us to look in the directory:

%SystemRoot%\Microsoft.NET\Framework

for subdirectories named "vN.N.NXXXX". There should be one of these directories for each of the .NET Framework versions installed on the computer.

In addition to figuring out which versions of the .NET Framework are installed, version 0.3 of FFClickOnce also reports that information to the webserver. It does so by altering Firefox's user agent string. The default Firefox user agent string is:

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8) Gecko/20060321 Firefox/2.0a1

Notice that this string has no information about which versions of the .NET Framework are installed. Now, here is an Internet Explorer user agent string:

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)

This user agent string indicates that there are two versions of the .NET Framework installed. If FFClickOnce were installed on a machine with these two versions of the .NET Framework, it would change the Firefox user agent string to:

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8; .NET CLR 1.1.4322; .NET CLR 2.0.50727) Gecko/20060321 Firefox/2.0a1

Unfortunately, this behaviour can cause the Java plugin (and possibly other plugins as well) to crash. This is due to a programming error, either in Firefox itself or the Java plugin, that limits Firefox's user agent string to 127 characters (plus a null terminator, I presume). When a user agent string exceeds this amount , it can cause the plugin loading process to fail. This is a bug in Firefox and its plugins. There is a bug report with more information at: https://bugzilla.mozilla.org/show_bug.cgi?id=328778

As of my latest testing, Firefox 1.5.0.4 crashes completely due to this bug. So does Firefox 2.0.0.1.

To avoid these bugs, FFClickOnce v0.4 will only include the version of the .NET Framework with the highest version number. Also, I have included an additional safety feature in the extension that stops FFClickOnce from changing the user agent string, if so doing will push the string length over the limit. The user will be informed if this happens. So, the user agent string in, for example Firefox 2.0.0.1, would be:

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.1; .NET CLR 2.0.50727) Gecko/20061204 Firefox/2.0.0.1

This action may not actually bring the user agent string below 127 characters, as other extensions may be adding to its length. However, once this feature has kicked in, it can be said that FFClickOnce is no longer contributing to the problem.

URL parameters, a feature of ClickOnce, should also work with FFClickOnce. For example, try the following test: http://www.softwarepunk.com/clickonce/tester/deploy/ClickOnceTester.application?x=abc&y=def

License

This software is licensed under the "MIT License", available from: http://www.opensource.org/licenses/mit-license.php. Here is the text of the license:

Copyright (c) 2006 James Dobson

Permission is hereby granted, free of charge, to any person obtaining
a copy of this software and associated documentation files (the
"Software"), to deal in the Software without restriction, including
without limitation the rights to use, copy, modify, merge, publish,
distribute, sublicense, and/or sell copies of the Software, and to
permit persons to whom the Software is furnished to do so, subject to
the following conditions:

The above copyright notice and this permission notice shall be
included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.

The source code for this software can be accessed by running an "unzip" program on the .xpi extension file.