IEInternals

A look at Internet Explorer from the inside out. @EricLaw left Microsoft in 2012, but was named an IE MVP in '13 & an IE userAgent (http://useragents.ie) in '14

IE9 RC Minor Changes List

IE9 RC Minor Changes List

  • Comments 44

Back in September, I published a list of minor changes in IE9 Beta. In today’s post, I will provide an updated list of things that have changed in the IE9 Release candidate. Note: This list also includes a few changes that were present in Beta that I didn’t mention at that time. Of course, because there are thousands of changes that I will not be covering, please do not mistake this for a comprehensive list, and please note that I'm deliberately skipping over the big feature improvements that will be discussed on the IEBlog.

Improvements in IE9 that impact issues or features previously discussed on this blog can be found by searching for the tag BetterInIE9.

Standards / Interop Improvements

  • Navigation triggered by window.location manipulation now sends a HTTP Referer header.
  • The postMessage() API now has asynchronous behavior for IE9 mode pages.
  • IE9 respects a FavIcon specified using a LINK REL="ICON" element (not requiring REL="SHORTCUT ICON") if a TYPE attribute is present with value "image/x-icon". Update IE11 dropped the type attribute requirement.
  • When in IE9 Browser Mode, IE now sends context-specific ACCEPT headers.
  • globalCompositeOperation support was added to CANVAS.
  • CANVAS supports toDataURL() after drawing same-origin VIDEO content. Note: The toDataURL() method incorrectly returns a trailing null byte at the end of the string; the fix for this just missed the RC build.
  • Several network cache correctness (age vs. max-age, Expires < Date) and clock-skew issues were fixed.
  • In IE9 standards-mode only, we now always encode FORM data as UTF-8 if the Accept-Charset attribute is present with the value “UTF-8”. The design of FORM encoding in IE8 and earlier was to use the encoding of the submitting page by default.  IE8 and earlier submit the form data using UTF-8 only if the FORM specified Accept-Charset=UTF-8 and the form contains some text that cannot be encoded in the page's encoding.
  • IE8 and IE9 Standards mode now correctly handle BASE tags that use the file:// protocol.
  • When uploading files from pages in IE9 document mode, IE will no longer send PNG and JPEG files with the pre-standards MIME types (image/x-png and image/pjpeg). Instead, IE will send image/png and image/jpg. Behavior in legacy modes is unchanged.
  • SCRIPT tags now fire an onload event.
  • File downloads may specify non-ASCII names by adding a filename* token to the Content-Disposition: attachment header. IE9 supports RFC5987 for UTF-8 filenames in the filename* parameter.
  • For IE9 Browser Mode, localStorage and sessionStorage evaluate the protocol/scheme when isolating storage per-origin.
  • The intrinsic size (up to 128x128) of a custom cursor is respected in IE9 document mode. Legacy IE modes scale all cursors to 32x32.
  • window.prompt() no longer triggers a security warning when called from the Internet zone.
  • Input and button elements inside anchor tags will now navigate if clicked.
  • The XMLHttpRequest object will create a responseXML document property if the server returns a MIME-type ending in +xml. Previously, the document would only be created for text/xml or application/xml.
  • FTP View now works properly with Unix FTP servers that have advanced permissions set.

Networking

  • SOCKS v4 proxies are supported again after being broken in IE9 beta.
  • Visiting pages on the Visual Studio Test Server (e.g. by hitting F5 in an ASP.NET web project) no longer shows Page Cannot Be Displayed errors (Connect #601047)
  • The FindMIMEFromData function used for MIME-sniffing now ignores any querystring component in pwzURL, if present.
  • Premature FIN detection was removed from WinINET. This is the subject of a future blog post.
  • Space characters embedded within Download filenames are no longer replaced with underscore characters.
  • Executable file downloads are no longer renamed when run from the cache.
  • When evaluating which, if any, registered MIME Filters to load, URLMon will now ignore the charset attribute in the server-specified Content-Type header.
  • If IE encounters a file download that is delivered with the wrong MIME type and is sniffed to .ZIP, it will not treat that file as a zip file if the file extension is on a list of known formats that are ZIP-derived. That list contains [".zipx", "accdt", "crtx", "docm", "docx", "dotm", "dotx", "gcsx", "glox", "gqsx", "potm", "potx", "ppam", "ppsm", "ppsx", "pptm", "pptx", "sldx", "thmx", "vdw", "xlam", "xlsb", "xlsm", "xlsx", "xltm", "xltx"].
  • Fixed IE9 Beta introduced regression whereby content delivered via the RES protocol was interpreted using an incorrect MIME type. That bug broke a number of applications.
  • For a file delivered as text/plain, if non-text characters are found (octets outside the 9-13, 27, 31-255 range), IE will treat the file as not really being text/plain and will trigger a file download dialog.
  • Downloaded files can now be saved from HTTPS sites even when sent with no-cache headers.
  • The XDomainRequest object no longer always fails when IE is running in InPrivate Browsing mode.
  • The proxy bypass list now supports a <-loopback> token enabling proxying of traffic sent to 127.0.0.1 or localhost.
  • When constructing the UserAgent string, IE9 no longer reads the Pre and Post Platform registry keys under \Internet Settings\User Agent\. It only reads those keys under \Internet Settings\5.0\User Agent\.
  • The about URL protocol no longer triggers Mixed Content Notifications.

Security

  • The prefix JavaScript: is stripped from any text pasted into the IE9 address bar. This mitigates a socially-engineered XSS attack common on social networks wherein users were tricked into performing self-inflicted XSS injections upon themselves.  No, CTRL+C,ALT+D,CTRL+V, ENTER will not give you magical powers
  • Interoperable :visited link protection was added to mitigate CSS History Probing. Unsupported styling patterns are now logged in the F12 Developer Tools console.
  • CSS MIME-type validation introduced in IE9 Beta was extended. Now, regardless of document mode or origin, if X-Content-Type-Options: nosniff is specified, the “stylesheet” MUST have a Content-Type of text/css or it will not be applied.
  • Pinned Site Mode treats certificate errors as fatal (with no override link). Combined with the fact that the pinned site itself can be pinned with a proper HTTPS URL, several “man-in-the-middle” threats are thwarted when a secure site is pinned to the taskbar.

Miscellaneous Changes

  • The window.navigator.appMinorVersion value was changed from “Beta” to “RC”. For the final release, it will be set to “0”.
  • In-place shell navigation within the Web Browser Control is no longer blocked.
  • .NET Framework XAML Browser applications (XBAPs) no longer run from the Internet zone; they still function in the Local Intranet and Trusted Zones.
  • The Format JavaScript option was added to F12 Developer Tools Script tab configuration button.
  • Direct Intranet Navigation is now possible. The Go to an intranet site for a single word entry option was added to Tools > Internet Options > Advanced. This allows you to prefer Intranet-navigation over automatic search behavior.
  • Drag/drop of favicon to desktop create and launches "sitemode" browser instance. Hold SHIFT to get the legacy behavior of adding a basic shortcut.
  • After forced restart (Windows Update), IE9’s tabs will be correctly restored.
  • IE9 features improved support for “Bookmarklets”—URL length limits were relaxed and several security prompts were tuned.
  • The New Tab Page no longer omits HTTPS pages unless the option “Do not save encrypted pages to disk” is set.

Performance Improvements

  • Myriad network performance improvements were made. These will be subject of an upcoming post on the IEBlog.
  • Major performance improvements were made to the XSS Filter.
  • Major improvements were made to performance of many CANVAS operations.
  • Significant responsiveness improvements were made when a CSS download is pending.
  • Find-on-page performance (especially when searching large documents) is dramatically improved.

 

You can read about other changes at IE9 on MSDN and examine the IE9 RC Release Notes. The team will be posting deep-dive details about major new features in IE9 over on the IEBlog.

That's it for now… I hope you enjoy the IE9 Release Candidate, available for download here.

-Eric

  • > IE9 will download the FavIcon for a LINK REL="ICON" tag if a TYPE attribute is present with value "image/x-icon".

    Theoretically, <link rel=icon href=foo.ico> (without the `type` attribute) should work too. Will this work in IE9?

    Also, why `image/x-icon`? I thought the correct MIME type for favicons was `image/vnd.microsoft.icon`.

  • @Mathias: No, without the TYPE attribute we won't try to use "icon", only "shortcut icon". The problem is that some sites point to a .PNG or GIF or other unsupported format.

    We use "image/x-icon" because that's the MIME type we've always used. Someone at some point (AFAIK, not related to Microsoft) proposed registration of the MIME type as "vnd.microsoft.icon", but Windows doesn't actually use that, it uses image/x-icon.

  • > The problem is that some sites point to a .PNG or GIF or other unsupported format.

    Wouldn’t it be possible to check the Content-Type header of the icon to see if the MIME type is supported if the `type` attribute is omitted?

  • @Mathias: It certainly would be possible (it's just code! :-), but that creates additional network traffic (additional round-trip) and a potential time delay (waiting to download the "shortcut icon" version after the "icon" version has failed).

  • What's the difference between "shortcut icon" and "FavIcon"?

  • @KS: "FavIcon" is our name for the overall feature that assigns an icon to a site. "Shortcut Icon" is the name of the META tag that IE5/6/7/8 look for, while "Icon" is what other browsers tend to look for.

  • > JavaScript: is stripped from any text pasted into the IE9 address bar.
    What is the purpose of stripping just javascript: ? Any text trailing that would be unusable as. Why not continue showing a warning prompt ?

  • @Parashuram: Because the user can easily type the protocol-specifier back into the address bar directly and get the execution behavior.

    There's really no warning prompt we could show the user that they would understand.

  • Eric, one of the most annoying problems I'm facing with an otherwise wonderful IE9, is the inability to run add-ons on pinned sites. I think pinned sites is one of the killer features of IE9, and I have quite a few of them pinned. But unfortunately add-ons like spellcheckers and adblockers don't run on those pinned sites. This is really frustrating.

    I understand it is a good idea to disable browser toolbars for pinned sites, but spellcheckers and adblockers are just as important on pinned sites as they are on the main browser.

    So, please consider giving an option to run add-ons in pinned sites. Or, can you please suggest an workaround with the registry?

    Thank you.

  • @Jonas: Sorry, there's no option or registry switch for that.

  • - For a file delivered as text/plain, if non-text characters are found (octets outside the 9-13, 27, 31-255 range), IE will treat the file as not really being text/plain and will trigger a file download dialog.

    What is the behavior when the content is delivered as Unicode text? I wouldn't expect that behavior for UTF-16, especially given your use of the word octet.

  • > Pinned Site Mode treats certificate errors as fatal (with no override link). Combined with the fact that the pinned site itself can be pinned with a proper HTTPS URL, several “man-in-the-middle” threats are thwarted when a secure site is pinned to the taskbar.

    Thanks, I can no longer pin my intranet sites.

  • @Alvaro: Sounds like your Enterprise PKI deployment is broken. Your IT admin should configure their root certificate authority as Trusted using Group Policy. Without this step, there's no point in using HTTPS at all, as content can be trivially intercepted and read/modified.

  • @Warren: Good question. In the case of Content-Type: text/plain; charset=utf-16, the file will be treated as a download. That hasn't changed vs. IE8, and Chrome 9 behaves the same way. Firefox4 and Opera11 render the text inline.

  • Hi Eric,

    Regarding the item for the XBAP, could you elaborate on why the IE team disabled this?  

    I'm thinking that a prompt dialog would have been a better trade-off.  Show prompts for full trust XBAPs and no prompts for other XBAPs.

    Thanks!

Page 1 of 3 (44 items) 123
Leave a Comment
  • Please add 8 and 1 and type the answer here:
  • Post