Wednesday, April 12, 2006
« DNR TV on CSLA .NET 2.0 | Main | What I've been reading lately »

I don't know how long this behavior has existed, but the other day I ran into an interesting (and unpleasant) side-effect of Microsoft's focus on security. I am guessing lots of people have run into this before me, but it was frustrating nonetheless.

It turns out that when you download a zip file with IE onto an NTFS drive, IE kindly puts a note in the file system indicating that the zip file came from an untrusted source (the Internet). When you unzip the contents to an NTFS drive, Windows kindly propagates that note, so all the unzipped files are marked as having come from an untrusted source.

In many cases you may not notice this flag. But if you unzip a VS 2005 solution like this and then try to open it VS will tell you it came from an untrusted source – possibly causing you some issues.

So of course the first question I asked was “how do I get rid of this note/flag so I can do my work?” There are some answers however.

You can go file-by-file and open each file’s properties dialog. Then you can click a button to mark it as trusted. You can’t do this at the folder level, only file-by-file. So this is pretty useless for a large number of source files.

You can copy the zip file and/or the unzipped contents to a FAT drive and back to your NTFS drive. Since FAT can’t store this metadata about the files, it is lost and your files are “fixed”.

You can use Firefox to download the zip file in the first place. Firefox doesn’t collaborate with Windows to protect you, so these security features (which I think are good in general terms). I’m not too thrilled by this discovery actually, as I think it illustrates a security hole (of sorts) in Firefox – at least as compared to IE.

I think you can mark the zip file as trusted (through its properties dialog) before unzipping the contents. Unfortunately I haven’t tried this (I actually stopped with using Firefox, because it did solve my problem :) )

Wednesday, April 12, 2006 5:34:54 PM (Central Standard Time, UTC-06:00)  #    Disclaimer  |  Comments [8]  | 

Thursday, April 13, 2006 2:41:16 AM (Central Standard Time, UTC-06:00)
IE stores the internet zone the file was downloaded from in a alternate NTFS datastream within the file, which gives us another solution. Download the streams utility from sysinternals.com
(http://www.sysinternals.com/Utilities/Streams.html)
which lists (and optionally deletes) alternate streams. It's got a recursive option, so all you need to do is

streams -s -d path/to/unzipped/solution

and it will get rid of them all. Alternatively, remove the stream from the .zip and unzip it again.
Dave Warry
Thursday, April 13, 2006 8:18:20 AM (Central Standard Time, UTC-06:00)
Another utility that includes source.


http://www.jameskovacs.com/blog/ZoneStripperUpdated.aspx
Paul Linville
Thursday, April 13, 2006 9:25:43 AM (Central Standard Time, UTC-06:00)
You can, indeed, the zip file as trusted before unzipping the contents.

I was actually impressed by this feature when I first came across it some time back. Now, I download a zip, browse through it, and if I am interested, click Unblock on the zip's properties before unzipping.
Raj Chaudhuri
Friday, April 14, 2006 2:20:56 PM (Central Standard Time, UTC-06:00)
I would guess that you could also use a different unzipper than the built in Windows one and this would "fix" in the same manner as FireFox by simply not supporting the feature.
Ryan
Friday, April 14, 2006 6:23:49 PM (Central Standard Time, UTC-06:00)
I'm not sure about that Ryan. At least WinZip honors the security scheme, because I did try that one. Perhaps some of the other compression tools are less secure and would "fix" the problem.
Friday, April 14, 2006 8:42:45 PM (Central Standard Time, UTC-06:00)
You can turn this setting off for all downloads if you like.
Start > Run > gpedit.msc
User Configuration > Administrative Templates > Windows Components > Attachment Manager
"Do not preserve zone information in file attachments" = Enabled

I got tired of it being a pain in the a** so I found this setting.
Mark Comeau
Monday, April 17, 2006 9:04:10 AM (Central Standard Time, UTC-06:00)
Rocky,

Thanks for the info. I like Mark's solution... that is if you can change the setting on the PC you are on ...sometimes the employer is a bit particular about changing settings... :(.

I must be blind, but I can't see how to do the following:

"You can go file-by-file and open each file’s properties dialog. Then you can click a button to mark it as trusted. You can’t do this at the folder level, only file-by-file. So this is pretty useless for a large number of source files."

Also... continuing my blindness... I can't see the "unblock" option with winzip.

Please assist the blind. :)
Mike
Wednesday, April 19, 2006 3:26:49 AM (Central Standard Time, UTC-06:00)
Mike,

If you right click a zip you have downloaded and pick properties then the UNBLOCK button should be sitting in the bottom right hand corner of the general page under the advanced button.

ChrisD
Comments are closed.