Browser Helper Object -> issues with Internet Explorer 9+

Question

I'm working on a Browser Helper Object (BHO) that I'm creating using Borland Delphi 6.0 (for the sake of completeness this is the 2001 era Delphi release which compiles a native 32-bit DLL that I register for use with Internet Explorer).

The purpose of the BHO is to add extra information to specific web page elements that isn't available with the original content. So, as an example of the sort of thing I'm trying to achieve, that might mean adding a tooltip to an image which displays details about what the picture is showing and when it was created - I use QTip for this purpose, a Javascript pop-up that builds upon JQuery.

I use the Delphi component of the BHO to search the DOM for page elements that I'm interested in modifying, wrap those elements in a span with a unique class attribute, then injects several scripts into the DOM HEAD (the scripts are compiled into the BHO as resources, retrieved on page load and then written out in full into the document - a new IHTMLScriptElement is created for each one, then the retrieved script is assigned to the text property of the script element).

The scripts deal with seeking our those spans, and then creating QTip objects that will appear when the user does a "mouse over" on any of the targeted page elements (there are 3 scripts, a copy of JQuery, a copy of QTip, and my script for seeking out the span elements).

This is all working well enough in my work environment: Windows XP SP3 with Internet Explorer 8.0

The problems begin when I register the BHO on a more recent Windows version with a more up-to-date copy of Internet Explorer - 9 or later. Here, when I open some web pages that I use for testing, a message appears at the bottom of the page stating:

"Only secure content is displayed"

And prompts me to Allow or disallow the blocked content. The blocked content appears to be the scripts that I am injecting into the page from my BHO.

So, question 1 is: is there any way that I can prevent IE from showing this message for my injected scripts without making changes to the client machine?

Separately, when I first register my BHO and start IE, I get a message at the bottom of the screen saying:

"The '' add-on from an unknown publisher is ready for use"

So question 2 is, uh, twofold. Firstly, is there any way I can mark my BHO "ready for use" programmatically when it is registered to prevent this message from appearing? Or, alternatively, what is the process for removing the sinister sounding "unknown publisher" label - I'm assuming this is going to involve some kind of expensive digital signing process, but I haven't been able to find any information about it.

Question 3, which follows on from the previous one, if I click "Enable" when IE tells me the "add-on... is ready for use" it doesn't work until I restart the web browser. I don't know whether there's any way to work around that and get it to begin functioning immediately, or otheriwse, of alerting the user to the fact that the browser must be restarted before it will do anything useful - suggestions?

Thank you in advance for any suggestions and your time

Addendum, SO is complaining that I need a reputation of 1500 or more to add some of the tags I thought were most relevant to my question (such as "browser helper object"), so apologies for choosing less meaningful ones in their places.

Answer 1

No, you cannot "pre-approve" your extension to avoid the " is ready for use" notification. If you attempt to do so, Microsoft will consider your extension malware and can block it from loading in IE entirely, treat sites that distribute it as malicious, etc. You simply shouldn't try it.

You must restart the browser to use the extension; there's no way to get it working until you restart the browser (or start a new tab that ends up in a new tab process).

The problem with your code is that it's injecting content that is not using a secure URL (e.g. injecting a HTTP URL into a HTTPS page). What sorts of URLs are you injecting? Are you using the RES:// protocol or a different protocol? If you're using a custom URL Protocol that your extension implements, you need to configure that protocol to be treated as a "secure" protocol (See the Query_Is_Secure flag in the QueryInfo method).