You posed an interesting problem...
My solution is to use the ActiveX component's InitProperties event to validate the URL of the page containing the proprietary control.
To prevent hackers or ripoff artists from easily changing the validation string in the object's code, I decided to use a simple hash.
I RADded this out in VB to reply quickly - hope you can easily implement the same concept in your C++ object.
Note that the page's URL is returned URL-encoded. In my local test case the page ends up stored locally, and for whatever reason such file URLs come back with a leading "/" character. Experiment with it!
I've tried to pre-fold the code so it won't get too mangled here, thus the HUGE number of VB line-continuations:
Code:
Option Explicit
'Secure my ActiveX Control from thieves!
'Example: [URL unfurl="true"]http://www.me.com/[/URL]
'Const clngLegal As Long = 27625
'Const clngLen As Long = 18
'/C:\Program%20Files\Microsoft%20Visual%20StudioConst clngLegal As Long = 76194
Const clngLen As Long = 48
Private Sub CheckLegality()
If Hash(Left(Parent.location.pathname, _
clngLen)) <> clngLegal Then
Err.Raise vbObjectError + &H2666, _
App.EXEName, _
"Illegal use of proprietary code"
End If
End Sub
Private Function _
Hash(ByVal strPath As String) As Long
Dim i As Long
strPath = LCase(strPath)
For i = 1 To Len(strPath)
Hash = Hash + _
Asc(Mid(strPath, i, 1))
Next
Hash = Hash * 17
End Function
Public Sub DoSomething()
MsgBox "My component in action!"
End Sub
Private Sub Command1_Click()
DoSomething
End Sub
Private Sub UserControl_InitProperties()
CheckLegality
End Sub
Here is a short VBScript for calculating the hash value to hardcode into your object:
Code:
Function Hash(ByVal strPath)
Dim i
strPath = LCase(strPath)
For i = 1 To Len(strPath)
Hash = Hash + _
Asc(Mid(strPath, i, 1))
Next
Hash = Hash * 17
End Function
s = InputBox _
("Warning - Use %20 for spaces" & _
vbCrLf & "URL Prefix to hash:")
MsgBox "Hash: " & CStr(Hash(s)) & _
vbCrLf & " Len: " & CStr(Len(s))
Note my use of aggressive line-folding here too.
Hope this helps give you ideas!
Be sure to encode your site's PREFIX and not the whole URL, else you'll be changing your object a lot or compiling copies for every page you use it on!
For the truly paranoid, change the prime constant 17 to something else so over-the-shoulder types here don't know what you are up to. Maybe 3, maybe a whole new hashing algorithm.
For the less paranoid chop the whole dang Hash thing out entirely.
Don't you just hate those "the web is open source" nuts when your boss/client is breathing down your neck with the company's Security Dude perched on his shoulder?
P.S. -
I'd love to hear about exploits that circumvent this. Am I missing anything really obvious here?
