- 如何禁止Internet Explorer的区域提升限制(Zone Elevation Blocks)






现象

在Internet内容区域的web页面中, 如果点击链接并跳转到Local Intranet内容区域, Internet Explorer将提出以下警告:

The current Internet site is trying to open a file that is on your Intranet. If you trust the current site to access your Intranet, proceed by clicking OK.

在Internet或Local Intranet内容区域的web页面中, 如果点击链接并跳转到Trusted内容区域, 将不会有任何提示信息或仅有一个脚本错误信息.
分析

Internet Explorer禁止跳转页面上的任何链接的安全内容比源URL的安全内容等级更高。这个新特性称之为区域提升限制(Zone Elevation Blocks)。安全内容的区域等级由高至低依次是: Restricted Sites zone, Internet zone, Local Intranet zone, Trusted Sites zone, and Local Machine zone.

解决

禁止区域提升限制(Zone Elevation Blocks):


打开Internet Explorer的Internet Options.
选择Security选项卡.
选择Local Intranet区域或Trusted Sites区域, 然后进入Custom Level.
设置"Web sites in less privileged web content zone can navigate into this zone"为启用.
===========================================

Internet Explorer Zone Elevation Blocks

Symptom:

On an Internet Zone web page, if you click a link to navigate to a page in the Local Intranet Zone, the following warning occurs:

The current Internet site is trying to open a file that is on your Intranet. If you trust the current site to access your Intranet, proceed by clicking OK.

On an Internet Zone web page or an Intranet Zone web page, if you click a link to navigate to a page in the Trusted Zone, nothing happens or a script error appears.
Analysis:

Internet Explorer prevents the overall security context for any link on a page from being higher than the security context of the root URL. This feature is called Zone Elevation Blocks. For the purpose of this mitigation, the security context ranking of the zones, from highest security context to lowest, is: Restricted Sites zone, Internet zone, Local Intranet zone, Trusted Sites zone, and Local Machine zone.

Solution:

Disable Zone Elevation Blocks:


Open Internet Options in Internet Explorer.
Click the Security tab.
Select the Local Intranet Zone or the Trusted Sites Zone, and then click Custom Level.
Change "Web sites in less privileged web content zone can navigate into this zone" to Enable.