Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation

Allow binary and script behaviors

This value controls whether dynamic binary and script behaviors may run for content in the Restricted Sites security zone.

since 0.9.8.11

Purpose

Show registry keys (2)
  • HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2000
  • HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2000

This value controls whether dynamic binary and script behaviors may run for content in the Restricted Sites security zone. These behaviors are components that attach functionality to HTML elements. The value name 2000 represents the URLACTION_BEHAVIOR_RUN URL security action.

The value uses the REG_DWORD data type. Its defined data values are:

  • 0 (0x00000000): Binary and script behaviors are allowed.
  • 3 (0x00000003): Binary and script behaviors are blocked.
  • 65536 (0x00010000): Only behaviors included in the administrator-approved behaviors list are allowed.

When behaviors are blocked, an application can handle the decision differently if it implements a custom security manager.

Notes

Security

The Restricted Sites zone is intended for content that should have limited access to active functionality. Allowing binary and script behaviors without restriction therefore increases the functionality available to such content and expands the attack surface presented by vulnerabilities or unwanted capabilities in installed behavior components.

This setting does not grant general administrative privileges or unrestricted access to files or other system resources. The effective capabilities depend on the particular behavior, the permissions of the hosting process, and other applicable security controls. The administrator-approved option limits execution to behaviors recorded in the separate trusted list.

Possible side effects

Blocking binary and script behaviors can prevent legacy websites or browser-based business applications that depend on DHTML behaviors from providing parts of their functionality or user interface.

Notes

This setting applies only to content assigned to zone 4, the Restricted Sites zone. Other security zones maintain separate values for the same URL security action.

When the corresponding policy values are absent, Microsoft’s policy description treats binary and script behaviors as unavailable in this zone. Applications that provide their own security manager can override that behavior.

Microsoft documentation

Microsoft Learn: InternetExplorer Policy CSP – RestrictedSitesZoneAllowBinaryAndScriptBehaviors

Microsoft Learn: URL Action Flags – URLACTION_BEHAVIOR_RUN

Microsoft Learn: URL Policy Flags

See also