DOCUMENT:Q185461  13-MAY-1998  [vbwin]
TITLE   :PRB: UseSafeSubset Allows Non-Safe Objects to Be Called
PRODUCT :Microsoft Visual Basic for Windows
PROD/VER:WINDOWS:4.0,5.0
OPER/SYS:WINDOWS
KEYWORDS:

======================================================================
---------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Visual Basic Standard, Professional, and Enterprise Editions,
   32-bit only, for Windows, version 4.0
 - Microsoft Visual Basic Learning, Professional, and Enterprise Editions
   for Windows, version 5.0
 - Microsoft Visual Basic for Applications version 5.0
---------------------------------------------------------------------

SYMPTOMS
========

When using the Microsoft Script control with the UseSafeSubset property set
to TRUE, script code is still able to instantiate objects that have not
been marked safe for scripting.

CAUSE
=====

The program is using version 1.0 of the Microsoft Script Control.

NOTE: An alternate cause, not addressed elsewhere in this article is that
your VBA application is resetting the UseSafeSubset property to FALSE.

STATUS
======

Microsoft is researching this problem and will post new information here in
the Microsoft Knowledge Base as it becomes available.

MORE INFORMATION
================

Microsoft provides programming examples for illustration only, without
warranty either expressed or implied, including, but not limited to, the
implied warranties of merchantability and/or fitness for a particular
purpose. This article assumes that you are familiar with the programming
language being demonstrated and the tools used to create and debug
procedures.

Steps to Reproduce Behavior
---------------------------

1. In Visual Basic create a new project and add the following component:

      Microsoft Script Control 1.0

2. Add the Script control (ScriptControl1), a text box (Text1), and a
   command button (Command1) to a form. In Visual Basic, set the MultiLine
   property of the text box to TRUE. For ease of use change the size of
   Text1 so that it will accomodate 5 lines of 60 characters.

3. Add the following code:

      Private Sub Command1_Click()
        On Error Resume Next
        With ScriptControl1
          .UseSafeSubset = True
          .Language = "VBScript"
          .AllowUI = True
          .AddCode Text1.Text
          .Run "Test"
        End With
      End Sub

4. Run the form and open the Debug window.

5. Type the following script into the text box. If you do not have
   Microsoft Excel, use a different server application.

      Sub Test()
      Dim X
        Set X = CreateObject("Excel.Application")
        X.Visible = True     ' this line is Excel-specific
        MsgBox "Pausing for effect...."
        Set X = Nothing
      End Sub

6. Click the command button. Microsoft Excel is displayed.

7. Click OK on the message box and Excel will close.



(c) Microsoft Corporation 1998, All Rights Reserved. Contributions by
Malcolm Stewart, Microsoft Corporation

Additional query words: kbAutomation kbScript kbVBp kbVBp500
kbVBp600
======================================================================
Version           : WINDOWS:4.0,5.0
Platform          : WINDOWS
Issue type        : kbprb

=============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.

Copyright Microsoft Corporation 1998.