IEInternals

A look at Internet Explorer from the inside out. @EricLaw left Microsoft in 2012, but was named an IE MVP in '13 & an IE userAgent (http://useragents.ie) in '14

IE9 RC Minor Changes List

IE9 RC Minor Changes List

  • Comments 44

Back in September, I published a list of minor changes in IE9 Beta. In today’s post, I will provide an updated list of things that have changed in the IE9 Release candidate. Note: This list also includes a few changes that were present in Beta that I didn’t mention at that time. Of course, because there are thousands of changes that I will not be covering, please do not mistake this for a comprehensive list, and please note that I'm deliberately skipping over the big feature improvements that will be discussed on the IEBlog.

Improvements in IE9 that impact issues or features previously discussed on this blog can be found by searching for the tag BetterInIE9.

Standards / Interop Improvements

  • Navigation triggered by window.location manipulation now sends a HTTP Referer header.
  • The postMessage() API now has asynchronous behavior for IE9 mode pages.
  • IE9 respects a FavIcon specified using a LINK REL="ICON" element (not requiring REL="SHORTCUT ICON") if a TYPE attribute is present with value "image/x-icon". Update IE11 dropped the type attribute requirement.
  • When in IE9 Browser Mode, IE now sends context-specific ACCEPT headers.
  • globalCompositeOperation support was added to CANVAS.
  • CANVAS supports toDataURL() after drawing same-origin VIDEO content. Note: The toDataURL() method incorrectly returns a trailing null byte at the end of the string; the fix for this just missed the RC build.
  • Several network cache correctness (age vs. max-age, Expires < Date) and clock-skew issues were fixed.
  • In IE9 standards-mode only, we now always encode FORM data as UTF-8 if the Accept-Charset attribute is present with the value “UTF-8”. The design of FORM encoding in IE8 and earlier was to use the encoding of the submitting page by default.  IE8 and earlier submit the form data using UTF-8 only if the FORM specified Accept-Charset=UTF-8 and the form contains some text that cannot be encoded in the page's encoding.
  • IE8 and IE9 Standards mode now correctly handle BASE tags that use the file:// protocol.
  • When uploading files from pages in IE9 document mode, IE will no longer send PNG and JPEG files with the pre-standards MIME types (image/x-png and image/pjpeg). Instead, IE will send image/png and image/jpg. Behavior in legacy modes is unchanged.
  • SCRIPT tags now fire an onload event.
  • File downloads may specify non-ASCII names by adding a filename* token to the Content-Disposition: attachment header. IE9 supports RFC5987 for UTF-8 filenames in the filename* parameter.
  • For IE9 Browser Mode, localStorage and sessionStorage evaluate the protocol/scheme when isolating storage per-origin.
  • The intrinsic size (up to 128x128) of a custom cursor is respected in IE9 document mode. Legacy IE modes scale all cursors to 32x32.
  • window.prompt() no longer triggers a security warning when called from the Internet zone.
  • Input and button elements inside anchor tags will now navigate if clicked.
  • The XMLHttpRequest object will create a responseXML document property if the server returns a MIME-type ending in +xml. Previously, the document would only be created for text/xml or application/xml.
  • FTP View now works properly with Unix FTP servers that have advanced permissions set.

Networking

  • SOCKS v4 proxies are supported again after being broken in IE9 beta.
  • Visiting pages on the Visual Studio Test Server (e.g. by hitting F5 in an ASP.NET web project) no longer shows Page Cannot Be Displayed errors (Connect #601047)
  • The FindMIMEFromData function used for MIME-sniffing now ignores any querystring component in pwzURL, if present.
  • Premature FIN detection was removed from WinINET. This is the subject of a future blog post.
  • Space characters embedded within Download filenames are no longer replaced with underscore characters.
  • Executable file downloads are no longer renamed when run from the cache.
  • When evaluating which, if any, registered MIME Filters to load, URLMon will now ignore the charset attribute in the server-specified Content-Type header.
  • If IE encounters a file download that is delivered with the wrong MIME type and is sniffed to .ZIP, it will not treat that file as a zip file if the file extension is on a list of known formats that are ZIP-derived. That list contains [".zipx", "accdt", "crtx", "docm", "docx", "dotm", "dotx", "gcsx", "glox", "gqsx", "potm", "potx", "ppam", "ppsm", "ppsx", "pptm", "pptx", "sldx", "thmx", "vdw", "xlam", "xlsb", "xlsm", "xlsx", "xltm", "xltx"].
  • Fixed IE9 Beta introduced regression whereby content delivered via the RES protocol was interpreted using an incorrect MIME type. That bug broke a number of applications.
  • For a file delivered as text/plain, if non-text characters are found (octets outside the 9-13, 27, 31-255 range), IE will treat the file as not really being text/plain and will trigger a file download dialog.
  • Downloaded files can now be saved from HTTPS sites even when sent with no-cache headers.
  • The XDomainRequest object no longer always fails when IE is running in InPrivate Browsing mode.
  • The proxy bypass list now supports a <-loopback> token enabling proxying of traffic sent to 127.0.0.1 or localhost.
  • When constructing the UserAgent string, IE9 no longer reads the Pre and Post Platform registry keys under \Internet Settings\User Agent\. It only reads those keys under \Internet Settings\5.0\User Agent\.
  • The about URL protocol no longer triggers Mixed Content Notifications.

Security

  • The prefix JavaScript: is stripped from any text pasted into the IE9 address bar. This mitigates a socially-engineered XSS attack common on social networks wherein users were tricked into performing self-inflicted XSS injections upon themselves.  No, CTRL+C,ALT+D,CTRL+V, ENTER will not give you magical powers
  • Interoperable :visited link protection was added to mitigate CSS History Probing. Unsupported styling patterns are now logged in the F12 Developer Tools console.
  • CSS MIME-type validation introduced in IE9 Beta was extended. Now, regardless of document mode or origin, if X-Content-Type-Options: nosniff is specified, the “stylesheet” MUST have a Content-Type of text/css or it will not be applied.
  • Pinned Site Mode treats certificate errors as fatal (with no override link). Combined with the fact that the pinned site itself can be pinned with a proper HTTPS URL, several “man-in-the-middle” threats are thwarted when a secure site is pinned to the taskbar.

Miscellaneous Changes

  • The window.navigator.appMinorVersion value was changed from “Beta” to “RC”. For the final release, it will be set to “0”.
  • In-place shell navigation within the Web Browser Control is no longer blocked.
  • .NET Framework XAML Browser applications (XBAPs) no longer run from the Internet zone; they still function in the Local Intranet and Trusted Zones.
  • The Format JavaScript option was added to F12 Developer Tools Script tab configuration button.
  • Direct Intranet Navigation is now possible. The Go to an intranet site for a single word entry option was added to Tools > Internet Options > Advanced. This allows you to prefer Intranet-navigation over automatic search behavior.
  • Drag/drop of favicon to desktop create and launches "sitemode" browser instance. Hold SHIFT to get the legacy behavior of adding a basic shortcut.
  • After forced restart (Windows Update), IE9’s tabs will be correctly restored.
  • IE9 features improved support for “Bookmarklets”—URL length limits were relaxed and several security prompts were tuned.
  • The New Tab Page no longer omits HTTPS pages unless the option “Do not save encrypted pages to disk” is set.

Performance Improvements

  • Myriad network performance improvements were made. These will be subject of an upcoming post on the IEBlog.
  • Major performance improvements were made to the XSS Filter.
  • Major improvements were made to performance of many CANVAS operations.
  • Significant responsiveness improvements were made when a CSS download is pending.
  • Find-on-page performance (especially when searching large documents) is dramatically improved.

 

You can read about other changes at IE9 on MSDN and examine the IE9 RC Release Notes. The team will be posting deep-dive details about major new features in IE9 over on the IEBlog.

That's it for now… I hope you enjoy the IE9 Release Candidate, available for download here.

-Eric

  • Hi....I have IE9 RC and I'm coming across this pop up from Internet Explorer that says Internet Explorer has modified this page to help prevent cross site scripting. How do I disable it on there cause really can't find out anything...I've looked but to no avail...thanks and hope to hear back from someone soon!!

  • @Don: The XSS Filter is a security feature. You shouldn't disable it; it keeps you safe from Cross-Site-Scripting attacks. You should notify the webmaster of whatever site you see this on that they have a security bug.

  • @Walter: Repro URL please?

  • >> @Tor: I'm very interested in learning more about your hundreds of customers. What Internet-Zone sites are your XBAPs in use upon? Thanks! <<

    @Eric: Sorry for the delay, I've been traveling for a few days. Our customers are Norwegian homeware/furniture retail stores. The users are are navigating to our web site (http://www.langlo.no) and starting the XBAP from there (login information required).

    We have not had to specify any specific internet zone or other settings for the users, I don't think they even know what that's all about. They are just using IE, and this is of course the great advantage here - the comfort zone and familiarity of IE combined with the power of WPF (incl. 3D) and a full .Net XBAP application under "the hood". Running under partial trust restriction has also allowed us to deploy the application without any problems or objections from our customers' I.T. departments.

  • @Eric: Windows application using the mshtml in a WebBrowser control. Checked out another one, has the same result. Ignores the DesignMode = "On"

    www.codeproject.com/.../ZetaHtmlEditControl.aspx

  • @Walter: There's something else going wrong in his code.

    If I set the following code:

    private void cbDesign_CheckedChanged(object sender, EventArgs e){

              var instance =

    Microsoft.VisualBasic.CompilerServices.NewLateBinding.LateGet(

    wbView.ActiveXInstance,

    null,

    @"Document",

    new object[0],

    null,

    null,

    null );

            var objArray1 = new object[] { cbDesign.Checked ? @"On" : @"Off" };

    Microsoft.VisualBasic.CompilerServices.NewLateBinding.LateSetComplex(

    instance,

    null,

    @"designMode",

    objArray1,

    null,

    null,

    false,

    true );

    The IE9 Web Browser instance enters designMode without any problems. If you change the "Zeta" example to not set the document text after entering design mode, it also works fine.

  • Thanks EricLaw .......this is happening on facebook and only when I try to post or share anything to get posted to there live feed and it just started on Friday.....before that it was fine. So I will get in touch with facebook and tell them they have a security bug in there system. Once again thank you for the info.....have a great Monday!!!

  • As you stated in the Stack Overflow posting, I modifed my code.

    I tried a thousand different things to no success. So if anyone else stumbles upon this blog posting and has a solution, I would love to read it!

  • @Uwe: As I mentioned, this code works just fine for me. If you look at what the Zeta example does, it resets the designMode attribute a bunch of times during the DOM manipulation (as the HTML is added). If you have a simple Web Browser Control based application, the simple code above works just fine.

  • @Eric Yes, I know and really welcome your feedback! I just cannot get it to work. It is really weird to me that the _same_ test app produces different results on different machines. http://twitpic.com/42ygnb/full

  • Internet Explorer 9 doesn't offer the option to open a html and mht documents served with content disposition attachment, in te save dialog. Can you restore this option?

    Thanks

  • @Michelle: If you choose SAVE, you can then choose OPEN directly from the dialog. In most cases where HTML content is served with Content-Disposition: attachment, the server is attempting to protect itself against untrusted content running in its security context. By saving the file locally first, this threat is mitigated because the reopened file will not run in the security context of the delivering site.

  • In the beta, if you went to Properties of a Pinned Site, you could change the icon and URL etc. In the RC, this Property Sheet was removed?

    [Ericlaw: The reason was that the dialog created problems with managing tasks that were defined by the site but didn’t match the startURL changed by the end-user. After removing this functionality, the only use for the dialog would’ve been changing the icon of the image.  We couldn’t justify supporting a dialog to update only the icon.]

  • Reading through some of your old posts, I see that you are a fan of AutoComplete. So am I, and I used it many times daily in IE8. The suggestions menu in the search bar showed first AutoComplete entries of previously used search strings, then provider suggestions, then pages from History. What happened to the search strings in IE9's One Box? I only see provider suggestions (if enabled) followed by page titles or URLs from History.

    In IE8, I built up a powerful library of complicated search strings which I could call up by typing a letter or two into the search bar. A hypothetical example:

    lr meta:search.lastRepliedUserName() site:answers.microsoft.com

    Type lr into the search bar and IE8 obliges by populating the box with the whole string on one click. Delete the lr and fill in the brackets, then click Bing. Bingo - a list of all threads where that user was the last poster. How do I do that in IE9? I have every conceivable AutoComplete option selected...

Page 3 of 3 (44 items) 123
Leave a Comment
  • Please add 2 and 2 and type the answer here:
  • Post