fractalnavel

so for the last couple of years (yep, years) there’s been this oddity about a customer’s website that wasn’t very serious, but was one of those eye scrunching, eyebrow raising sort of things.  the first report of something flaky was a design consultant who was alarmed: “did you know that your website is trying to load flash and adobe reader every time i visit?” she warned.  i was like, funny, but i never see that.  basically, we ignored them; they weren’t very good at their jobs anyway.

but sometime later, i noticed the site started wanting to load adobe reader (just the runtime, not the gui) on every visit to every page (if it wasn’t already loaded).  but not in every environment, just in some of them, and just in ie.  i figured, whatever, maybe the designer gave us some funky images, most of the work was crap anyway.  again, it was just a shoulder shrug, not a big deal, no one else even seemed to notice anything.

this has continued to occur ever since, and i was always a bit curious.  then today i decided to poke into it a bit closer.  the new installation of ie8 is more locked down than how i normally run (which is still far more restricted than most people), so up pops the “do you want to run this add-in?” bar when i visit the site, instead of just loading adobe reader in the background.  and hey – it was some new information !  it was trying to load adobe svg viewer.  but only on machines that had it installed.  this new bit of info motivated me to look closer.  turns out this is an obsolete plug-in, only likely to be around on older systems, or – ha! – designers’ desktops, due to their frequent use of adobe tools.  pretty badly behaved too, to have a plug in need to load something as clunky as adobe reader.

so what was causing it to try to load ?  poking around with fiddler & the ie dev toobar, i couldn’t spot anything in particular about the headers (whoever installed office server extensions on that server needs to be - something), the html, the css, the images (for a moment there, i even suspected the favicon), the scripts – nothing.  or so i thought…

finally, disabling the scripts stopped the add-in request.  huh.  stepping through, i found the following: it’s an old awstats script, the one that’s supposed to track miscellaneous browser capabilities – and which had never worked anyway.  it’s been there all along. 

what was it doing ?  ugly stuff:

if (TRKie && TRKwin) {
    TRKshk = awstats_detectIE("SWCtl.SWCtl.1");
    TRKsvg = awstats_detectIE("Adobe.SVGCtl");
    TRKfla = awstats_detectIE("ShockwaveFlash.ShockwaveFlash.1");
    TRKrp  = awstats_detectIE("rmocx.RealPlayer G2 Control.1");
    TRKmov = awstats_detectIE("Quicktime.Quicktime");
    TRKwma = awstats_detectIE("wmplayer.ocx");
    TRKpdf = 'n'; TRKpdfver='';
    if (awstats_detectIE("PDF.PdfCtrl.1") == 'y') { TRKpdf = 'y'; TRKpdfver='4'; } // Acrobat 4
    if (awstats_detectIE('PDF.PdfCtrl.5') == 'y') { TRKpdf = 'y'; TRKpdfver='5'; } // Acrobat 5
    if (awstats_detectIE('PDF.PdfCtrl.6') == 'y') { TRKpdf = 'y'; TRKpdfver='6'; } // Acrobat 6
    if (awstats_detectIE('AcroPDF.PDF.1') == 'y') { TRKpdf = 'y'; TRKpdfver='7'; } // Acrobat 7
}

and

function awstats_detectIE(TRKClassID) {
    TRKresult = false;  // !!! Adding var in front of TRKresult break detection !!!
    document.write('<SCR' + 'IPT LANGUAGE="VBScript">\n on error resume next \n TRKresult = IsObject(CreateObject("' + TRKClassID + '")) \n </SCR' + 'IPT>\n');
    if (TRKresult) return 'y';
    else return 'n';
}

good lord, it’s testing for plug-ins by attempting to instantiate them !  and with vbscript, no less !

oh fer… mystery solved.

and shame on awstats.

so, need to just scrap that script.  and personally, i’m uninstalling that plug-in wherever i find it.  have to use add/remove programs for that.

there’s a lesson or two here.  hard to say what they are.  one of the reasons to do good work is so that people listen to you when you notice a problem.  but this was one of those oddball now you see it, now you don’t sort of issues, tough to nail down.

well, guess what ?  NAILED.

:-p

update 2009.04.02:

i was wondering if merely removing that svg plugin would solve the adobe reader load - not sure why it seemed to, since the code says it won't - and it doesn't - sometimes.  i could have sworn ...  i guess there's more complexity to that than i thought.  like having old adobe artifacts on the system or something, because on a cleaner box, only the presence or absence of the svg plug-in seems to make a difference.  odd, since the reader progid (AcroPDF.PDF) hasn't changed for a while.  maybe it's just a difference in the behavior of the adobe plug-in itself.  anyway, bottom line: that's an undesirable feature sniffing technique.  and i should never have used something i didn't look closely at.  but then - what about things like google anaalytics ?  no easy answers.

this is uncalled for:

if i wanted to check for malicious software, i wouldn't be installing ie - i'd be running a
"malicious software checker".  and it's not even optional.

seriously, are they trying to discourage people from using their stuff, or what ?