HTML Application: Difference between revisions

Revision as of 09:55, 14 August 2023

Latest revision as of 20:50, 26 August 2025

(13 intermediate revisions by 13 users not shown)

Line 24:

| standard =

| free =

| url = {{URL|1=https://msdnlearn.microsoft.com/en-us/libraryprevious-versions/ms536471(VSv=vs.85).aspx?redirectedfrom=MSDN}}

}}

An '''HTML Application''' ('''HTA''') is a [[Microsoft Windows]] program whose source code consists of [[HTML]], [[Dynamic HTML]], and one or more scripting languages supported by [[Internet Explorer]], such as [[VBScript]] or [[JScript]]. The HTML is used to generate the user interface, and the scripting language is used for the program logic. An HTA executes without the constraints of the internetweb browser security model; in fact, it executes as a "fully trusted" application.

The usual file extension of an HTA is <code>.hta</code>.

The ability to execute HTAs was introduced to Microsoft Windows in 1999, along with the release of [[Microsoft Internet Explorer 5]].<ref>[http://support.microsoft.com/kb/200874 ''Article ID:200874 in Microsoft Support''], in Microsoft Support Knowledge Base</ref> On December 9, 2003, this technology was [[patent]]ed.<ref>[http{{Cite patent|number=US6662341B1|title=Method and apparatus for writing a windows application in HTML|gdate=2003-12-09|invent1=Cooper|invent2=Kohnfelder|invent3=Chavez|inventor1-first=Phillip R.|inventor2-first=Loren M.|inventor3-first=Roderick A.|url=https://newspatents.cnetgoogle.com/2100patent/US6662341B1/en?oq=PN/6,662,341}}</ref><ref>{{Cite web |last=Festa |first=Paul |date=2003-1012_312-5119072.html10 |title=Microsoft wins HTML application patent |url=http://www.cnet.com/news/microsoft-wins-html-application-patent/ |url-status=dead |archive-url=https://web.archive.org/web/20160310170211/http://www.cnet.com/news/microsoft-wins-html-application-patent/ |archive-date=2016-03-10 |access-date=2016-01-10 |website=[[CNET]]}}</ref>

== Uses ==

Line 44:

An HTA is treated like any executable file with extension [[EXE|<code>.exe</code>]]. When executed via mshta.exe (or if the file icon is double-clicked), it runs immediately. When executed remotely via the browser, the user is asked once, before the HTA is downloaded, whether or not to save or run the application; if saved, it can simply be run on demand after that.<ref name=msintro/>

By default, HTAs are rendered as per "standards-mode content in IE7 Standards mode and quirks mode content in IE5 (Quirks) mode", but this can be altered using <code>X-UA-Compatible</code> headers.<ref name=msintro>{{cite web |url=https://msdn.microsoft.com/en-us/library/ms536496%28v=vs.85%29.aspx#Compatibility |title=Introduction to HTML Applications (HTAs).|website=MicrosftMicrosoft MSDN|date=May 2011 |access-date= 24 June 2016}} Sections include Why Use HTAs, Creating an HTA, HTA-Specific Functionality, Security, Compatibility, Deployment</ref>

HTAs are dependent on the Trident (MSHTML) browser engine, used by [[Internet Explorer]], but are not dependent on the Internet Explorer application itself. If a user [[Removal of Internet Explorer|removes Internet Explorer]] from Windows, via the Control Panel, the MSHTML engine remains and HTAs continue to work. HTAs continue to work in Windows 11 as well.

Line 66:

HTA have been used to deliver malware.<ref>{{Cite web|url=https://www.vmray.com/cyber-security-blog/spora-ransomware-dropper-hta-infect-system/|title=Spora Ransomware Dropper Uses HTA to Infect System|date=2017-01-17|website=VMRay|language=en-US|access-date=2018-12-22}}</ref><ref>{{Cite web|url=https://blog.netwrix.com/2017/06/01/nine-scariest-ransomware-viruses/|title=8 Scariest Ransomware Viruses|language=en-US|access-date=2018-12-22}}</ref> One particular HTA, named ''[[4chan]].hta'' (detected by antiviruses as JS/Chafpin.gen), was widely distributed by the users of the imageboard as a [[steganographic]] image in which the user were instructed to download the picture as an HTA file, which when executed, would cause the computer to automatically spam the website (evading 4chan's [[CAPTCHA]] in the process) with alternate variants of itself; it was reported that such attacks were previously delivered in which the user was prompted to save it as a [[JavaScript|.js]] file.<ref>{{cite web |last1=Constantin |first1=Lucian |title=4chan Flood Script Is Back with New Social Engineering Trick |url=https://news.softpedia.com/news/4chan-Flood-Script-Is-Back-with-New-Social-Engineering-Trick-151603.shtml |website=Softpedia |access-date=2021-11-09 |date=2010-08-10}}</ref>

==Example==

def distance_between_points(lat1, lon1, lat2, lon2):

This is an example of [["Hello, World!" program|Hello World]] as an HTML Application.

"""Calculates the distance between two latitude-longitude points.

Args:

<syntaxhighlight lang="html">

lat1: The latitude of the first point.

<HTML>

lon1: The longitude of the first point.

<HEAD>

lat2: The latitude of the second point.

<HTA:APPLICATION ID="HelloExample"

lon2: The longitude of the second point.

BORDER="bold"

Returns:

BORDERSTYLE="complex"/>

The distance between the two points in kilometers.

<TITLE>HTA - Hello World</TITLE>

"""

</HEAD>

# Convert the latitude and longitude values to radians.

<BODY>

lat1 = math.radians(lat1)

<H2>HTA - Hello World</H2>

lon1 = math.radians(lon1)

</BODY>

lat2 = math.radians(lat2)

</HTML>

lon2 = math.radians(lon2)

</syntaxhighlight>

# Calculate the distance between the two points.

d = math.acos(

math.sin(lat1) * math.sin(lat2) +

math.cos(lat1) * math.cos(lat2) * math.cos(lon1 - lon2))

# Convert the distance to kilometers.

return d * 6371

== See also ==

Line 110 ⟶ 105:

{{Internet Explorer}}

[[Category:HTML|Application]]

[[Category:Internet Explorer]]

[[Category:User interface markup languages]]