Accelerator tags are used to instruct IE how to use, display, and execute a specific extension. Table 4-2 outlines the tags that can be used in constructing an Accelerator XML definition file and their individual descriptions.

The <os:openServiceDescription> tag is the root tag in an extension's XML definition. The set of tags directly following the root (<os:homepageUrl>, <os:display>, <os:name>, <os:icon>, and <os:description>) represents metadata that explains what the control is and does.

<os:activity> contains action tags that inform IE how to send page content to one or many web services. It also contains one metadata element—the category attribute—allowing developers to specify the type of the add-on (such as Mail, Maps, or Search).

Actions (<os:activityAction>) define the context or contexts in which the Accelerator can be run: selection (representing content highlighted on a page), document (representing the document itself), and link (an <a> tag referring to a URL).

The last tags, execute and/or preview, define the events an action will respond to. The execute tag (<os:execute>) handles the onClick event, fired when a user clicks an Accelerator's context menu item. The preview tag (<os:preview>) is used for the onHover event of that same object (when a user places their mouse over that same item). One or both of these tags must be present in an action.

The OpenService XML definition provides variables as a way for IE to know what page content it should send to a web service. They represent items such as the source URL, content that was highlighted, and information about a link. They are only permitted within <os:preview>, <os:execute>, and <os:parameter> tags—the tags ultimately responsible for instructing IE how to talk to web services.

Table 4-3 outlines the variables IE can pass to a web service.

Security and privacy mitigations prevent variables from being used in all cases. The following rules are in place to limit the amount of potentially private data leaked to a web service:

The XML file that defines Tweet This! is used by IE to create a new context menu UI element and access the web service. The code sample in Listing 4-1 shows this markup.

<?xml version="1.0" encoding="UTF-8" ?>
<os:openServiceDescription
   xmlns:os="http://www.microsoft.com/schemas/openservicedescription/1.0">
   <os:homepageUrl>http://examples.proiedev.com/04/basic/xmlservice/</os:homepageUrl>
   <os:display>
      <os:name>Tweet This!</os:name>

<os:icon>http://examples.proiedev.com/04/basic/xmlservice/favicon.ico</os:icon>
      <os:description>Tweet website content to your Twitter account.</os:description>
   </os:display>
   <os:activity category="Twitter">
      <os:activityAction context="selection">
         <os:execute
            action="http://examples.proiedev.com/04/basic/xmlservice/service.php"
            method="get">
            <os:parameter name="mode" value="execute" type="text" />
            <os:parameter name="type" value="selection" type="text" />
            <os:parameter name="documentUrl" value="{documentUrl}" type="text" />
            <os:parameter name="selection" value="{selection}" type="text" />
         </os:execute>
      </os:activityAction>
   </os:activity>
</os:openServiceDescription>

The definition begins by creating a root <os:openServiceDescription> tag. The home page of the Accelerator is set in <os:homepageUrl> tags. Display information is defined in the <os:display> tag: the name is Tweet This, the icon is an ICO file residing on the same domain as the <os:homepageUrl>, and the description reads "Tweet website content to your Twitter account."

The <os:activity> defines how IE will call the Twitter web service handler. This example uses the category attribute tag to state that its category is a Twitter extension. The <os:activityAction> tag tells the browser to send the currently selected content to the web service if it's being used in the context of a selection. (Since only the selection context was defined, IE will not send information or display the Accelerator when nothing on the current page is selected).

The <os:execute> tag binds the <os:activityAction> tag to the extension's click event. It also specifies the web service URL with the action attribute and the HTTP method in the method attribute. <os:execute> has four child <os:parameter> tags, each defining a piece of data that IE will send to Twitter. The first two are hard-coded variables that indicate the initiating event (execute) and the context (selection). The last two parameters surface the source document's URL {documentURL} and the text selected on that page {selectedText}.

The Tweet This! Accelerator uses a server-side script (shown in Listing 4-2) to convert data sent from IE into a Twitter post. The script submits a string no longer than 140 characters and one that contains plain text. In addition to the posting requirements, this script includes a link to the source page that is minified through a URL-shortening service.

<?php

   //  Include some necessary functions (truncateString, getHTTPVar, ...)
   require_once('functions.php'),

   //  Set the HTTP method used for passed variables
   $method             = METHOD_GET;

   //  Get values from HTTP variables
   $documentUrl        = getHTTPVar("documentUrl",   $method);
   $selection          = getHTTPVar("selection",     $method);

   //  Function to build a tweet (minify a URL and truncate a string
   //  to 140 characters)
   function buildTweet() {

      global $documentUrl;
      global $selection;

      //  Minify the URL (e.g., TinyURL)
      $minifiedURL = minifyURL($documentUrl);

      //  Truncate the text + URL to 140 characters or less
      $output  = truncateString($selection, 140 - strlen($minifiedURL));
      $output .= " " . $minifiedURL;

      //  Return the output (urlencoded if specified)
      return  urlencode($output);

   }

   //  Execute the Accelerator
   header('Location: http://twitter.com/home?status=' . buildTweet(true));

?>

The web service begins by reading the document URL and the page selection sent to it via an HTTP GET request. The page uses a special function for this (getHTTPVar()) that sanitizes the string for safe use. The document URL is then made into a short string (minified) through TinyURL.

The script takes selected content and minified URL and uses them to create a new message that is 140 or less characters in length. This value is sent to Twitter through an HTTP redirect, posting the string to a user's account (one opened in the same session context as the Accelerator).

The selection context represents content selected on a web page. Selected content can be text or a combination of text, images, and other content. Data from the selection context is served to a web service via the {selection} variable as either text or HTML. Listing 4-3 shows an XML definition that registers for the selection context.

...
<os:activityAction context="selection">
   <os:execute
      action="http://examples.proiedev.com/04/basic/post/service.php"
      method="post">
      <os:parameter name="mode" value="execute" type="text" />
      <os:parameter name="type" value="selection" type="text" />
      <os:parameter name="documentUrl" value="{documentUrl}" type="text" />
      <os:parameter name="selection" value="{selection}" type="text" />
   </os:execute>
</os:activityAction>
...

An action registers for the selection context through the context attribute of <os:activityAction>, setting its value to selection. The content can be passed to a web service through the {selection} variable previously mentioned. You can set web services to receive text contained within a selection by setting the type attribute of the parameter using the {selection} variable to text. You can set them to receive HTML from this variable by setting the same attribute to html.

Listing 4-4 shows the Tweet This! Accelerator handling content from the selection context.

//  Set the HTTP method used for passed variables
$method             = METHOD_POST;

//  Get values from HTTP variables
$documentUrl        = getHTTPVar("documentUrl",   $method);
$selection          = getHTTPVar("selection",     $method);

//  Function to build a tweet (minify a URL and truncate a string
//  to 140 characters)
function buildTweet() {

  global $documentUrl;
  global $selection;

  //  Minify the URL (e.g., TinyURL)
  $minifiedURL = minifyURL($documentUrl);

  //  Truncate the text + URL to 140 characters or less
  $output  = truncateString($selection, 140 - strlen($minifiedURL));

$output .= " " . $minifiedURL;

  //  Return the output (urlencoded if specified)
  return  urlencode($output);

}

In this example, the web service grabs the values from {documentUrl} and {selection} through the HTTP request. It proceeds to build a new Twitter message whose content is based on the {selection} text and that creates a link to the value stored in {documentUrl}.

Special care should be used when accepting HTML from the {selection} variable. Content in this context could contain script intended for cross-site scripting attacks. IE's XSS filter will trigger if the browser detects script being displayed directly from this context in a web service; however, it will not catch all instances. Web services intending to receive raw HTML content from a selection context should properly sanitize this content before using it for internal functionality or displaying it to users.

The link context represents Accelerators run when a link is the target of Accelerator execution. Links include any object (text, image, or otherwise) that is encapsulated in an <a> tag. Accelerators opting into this context have a number of link-specific variables available to them: {linkText}, {linkRel}, {linkType}, {linkDomain}, and {linkHost}. Listing 4-5 shows the Tweet This! Accelerator opting into the link context.

...
<os:activityAction context="link">
   <os:execute
      action="http://examples.proiedev.com/04/content/link/service.php"
      method="post">
      <os:parameter name="link" value="{link}" type="text" />
      <os:parameter name="linkText" value="{linkText}" type="text" />
   </os:execute>
</os:activityAction>...

An action registers for the link context through the context attribute of <os:activityAction>, setting its value to link. The content can be passed to a web service through any of the {link...} variables. These variables can only be transmitted via text formatting (unlike {selection}, which can be sent as either text or HTML).

Listing 4-6 shows the Tweet This! web service extended to handle the link context. In this case, the service uses the {linkText} passed from the Accelerator as the message content and the {link} variable as the target URL.

//  Set the HTTP method used for passed variables
$method             = METHOD_POST;

//  Get values from HTTP variables
$link               = getHTTPVar("link",         $method);
$linkText           = getHTTPVar("linkText",     $method);

//  Function to build a tweet (minify a URL and truncate a string
//  to 140 characters)
function buildTweet() {

  global $link;
  global $linkText;

  //  Minify the URL (e.g., TinyURL)
  $minifiedURL = minifyURL($link);

  //  Truncate the text + URL to 140 characters or less
  $output  = truncateString($linkText , 140 - strlen($minifiedURL));
  $output .= " " . $minifiedURL;

  //  Return the output (urlencoded if specified)
  return  urlencode($output);

}

The document context represents execution of an Accelerator without a clear target—essentially, it is the catchall case, covering everything besides selection or link targeting. For instance, right-clicking any space in a document or on an image will trigger Accelerators opting into the document context. The {documentUrl}, {documentTitle}, {documentDomain}, and {documentHost} variables are available in this context. Listing 4-7 shows the Tweet This! Accelerator handling the document context.

...
<os:activityAction context="document">
   <os:execute
      action="http://examples.proiedev.com/04/content/link/service.php"
      method="post">
      <os:parameter name="documentUrl" value="{documentUrl}" type="text" />
      <os:parameter name="documentTitle" value="{documentTitle}" type="text" />
   </os:execute>
</os:activityAction>
...

An action registers for the document context through the context attribute of <os:activityAction>, setting its value to document. The content can be passed to a web service through any of the {document...} variables. These variables can only be transmitted via text formatting.

Listing 4-8 shows the Tweet This! web service handling the document context. In this case, the service uses the {documentTitle} as the Twitter post content and the {documentUrl} as the target link.

//  Set the HTTP method used for passed variables
$method             = METHOD_POST;

//  Get values from HTTP variables
$documentUrl        = getHTTPVar("documentUrl",   $method);
$documentTitle      = getHTTPVar("documentTitle", $method);

//  Function to build a tweet (minify a URL and truncate a string
//  to 140 characters)
function buildTweet() {

  global $documentUrl;
  global $documentTitle;

  //  Minify the URL (e.g., TinyURL)
  $minifiedURL = minifyURL($documentUrl);

  //  Truncate the text + URL to 140 characters or less
  $output  = truncateString($documentTitle, 140 - strlen($minifiedURL));
  $output .= " " . $minifiedURL;

  //  Return the output (urlencoded if specified)
  return  urlencode($output);

}

The most common method for installing and deploying Accelerators is through a web page using markup and JavaScript. Accelerators can be installed using the AddService() function, located on the window.external JavaScript object (see Listing 4-11).

window.external.AddService('twitter.Accelerator.xml'),

This call can be tied to any user-initiated object or event such as the onClick event of a <button>. Listing 4-12 shows a link that allows a user to install the Tweet This! Accelerator when clicked.

<a href="javascript:window.external.AddService
  ('twitter.Accelerator.xml'), return false;">
  Install the Tweet This! Accelerator
</a>

Invocation of AddService() presents a user with an installation dialog (see Figure 4-7). The dialog contains an Accelerator's name, source web site, destination, and category. A user may set the new Accelerator as the default service provider for a specific category.

Figure 4.7. The Accelerator installation dialog

Users can access the new Accelerator through the context menu immediately after installation.

window.external.isServiceInstalled('twitter.Accelerator.xml'),

Accelerator installation is not limited to web sites; binary applications that wish to install Accelerators can do so through public OpenService COM interfaces. These interfaces expose functionality that mimics that found in the JavaScript functions, allowing Accelerators to be installed by pointing IE to the URL of their XML definition. The following sections demonstrate these interfaces and detail how Accelerators are stored in the registry and user-owned folders after installation.

Using the OpenService COM Interfaces

IE exposes a number of interfaces that handle the installation and management of Accelerators. Exposed OpenService interfaces may be found in the openservice.idl definition file.

Binary applications installing Accelerators will use two interfaces and one coclass to do so: IOpenServiceManager, IOpenService, and the OpenServiceManager coclass. Listing 4-14 shows a C# interop file that defines the existence of these items for use in a .NET application.

Example 4.14. C# Interop Definition for Interfaces Used in Accelerator Installation

[Guid("098870b6-39ea-480b-b8b5-dd0167c4db59")]
[ComImport, ClassInterface(ClassInterfaceType.None)]
public class OpenServiceManager
{
   //  Coclass exposed through IEOpenServiceObjects
}

[Guid("5664125f-4e10-4e90-98e4–e4513d955a14")]
[ComImport, InterfaceType(ComInterfaceType.InterfaceIsIUnknown)]
public interface IOpenServiceManager
{
   void InstallService(
      [MarshalAs(UnmanagedType.LPWStr)] string pwzServiceUrl,
      out IOpenService ppService);

   void UninstallService(
      IOpenService pService);

   void GetServiceByID(
      [MarshalAs(UnmanagedType.LPWStr)] string pwzID,
      out IOpenService ppService);
}

[Guid("C2952ED1-6A89-4606-925F-1ED8B4BE0630")]
[ComImport, InterfaceType(ComInterfaceType.InterfaceIsIUnknown)]
public interface IOpenService
{
   void IsDefault(
      [MarshalAs(UnmanagedType.Bool)] out bool pfIsDefault);

   void SetDefault(
      [MarshalAs(UnmanagedType.Bool)] bool fDefault,
      IntPtr hwnd);

   void GetID(
      [MarshalAs(UnmanagedType.BStr)] out string pbstrID);
}

A sample project—the Manage Accelerators application—was created to highlight the use of the OpenService COM definitions. The sample shown in Figure 4-8 is a simple form containing a text box, a check box, and a button.

Figure 4.8. The Manage Accelerators sample application

The text box accepts a URL pointing to an Accelerator's XML definition file. The check box tells the sample to either request that the Accelerator be installed as a default for its category (checked) or install without requesting default status (unchecked). The button handles the installation process through its mouse click event handler.

The installation process, shown in Listing 4-15 through an event handler, begins with the definition of IOpenServiceManager and IOpenService objects. The openServiceManager variable is set to a new instance of the OpenServiceManager coclass, based on the IOpenServiceManager interface. The openService variable is defined as an IOpenService type but is left uninitialized; the installer function will use this variable to reference a new IOpenService object created during the installation process.

Example 4.15. Button Event Handler That Triggers an Accelerator Installation

//  Handle the onClick event of the Install button
private void buttonInstallAccelerator_Click(object sender, EventArgs e)
{

   //  Create the OpenServiceManager and IOpenService objects
   IOpenServiceManager openServiceManager = (IOpenServiceManager) new OpenServiceManager();
   IOpenService openService;

   //  Install the service and have an object representation saved to
   //  the openService placeholder
   openServiceManager.InstallService(
      this.textServiceURL.Text,      // URL of the Accelerator
      out openService                // Created OpenService object
      );

   //  If instructed to set as default, do so by calling the SetDefault
   //  function on the openService object.  Send this form's window handle
   //  in case a modal dialog needs to be thrown
   if (this.checkDefault.Checked)
      openService.SetDefault(true, this.Handle);

}

The InstallService() function is called from the openServiceManager variable to initiate an Accelerator installation. This function accepts a URL pointing to an XML file (in this case, the string is found in the sample application's text box) and a variable to write a newly created IOpenService object (the uninitialized openService variable in Listing 4-15). If this function successfully installs the Accelerator, the openService variable will be set to a valid object using the IOpenService interface.

Successfully installed Accelerators can be set as the default extension in their category through the SetDefault() method on an IOpenService object. The Manage Accelerators example provides a check box allowing a user to decide if an Accelerator should be installed as a default. The SetDefault() function is called on the openService variable when this option is selected. This function accepts two parameters: a Boolean setting the Accelerator to the default (true) or not (false), and a window handle (HWND) of a visible window owned by the calling application.

HKEY_CURRENT_USER
   Software
      Microsoft
         Windows
            CurrentVersion
               Internet Settings
                  Activities
                     (Category)
                        (Domain)
                           (Action1)
                              preview
                                 (Parameter1)
                                 ...
                                 (Parametern)
                              execute
                                 (Parameter1)
                                 ...
                                 (Parametern)
                           (Action2)
                              ...
                           (Action3)
                              ...

public enum OpenServiceActivityContentType
{
   ActivityContentNone = −1,     // Ignore
   ActivityContentDocument,      // 1
   ActivityContentSelection,     // 2
   ActivityContentLink,          // 4
   ActivityContentCount          // Ignore
};

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet SettingsActivitiesTwitter]

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet SettingsActivitiesTwitterproiedev.com]
"Icon"="C:\Users\mattcrow\AppData\LocalLow\Microsoft\Internet Explorer\Services\Twitter_proiedev.com.ico"
"Description"="Tweet website content to your Twitter account."
"HomepageURL"="http://examples.proiedev.com/04/twitter/"
"Domain"="proiedev.com"
"Verb"="Twitter"
"DisplayName"="Tweet This!"
"XMLUrl"="http://examples.proiedev.com/04/twitter/twitter.xml"
"XML"="C:\Users\mattcrow\AppData\LocalLow\Microsoft\Internet Explorer\Services\Twitter_proiedev.com.xml"
"DownloadUrl"="http://examples.proiedev.com/04/twitter/"
"Type"=dword:00000001
"Enabled"=dword:00000001
"Deleted"=dword:00000000
"ActionCount"=dword:00000003
"ContentMask"=dword:00000007

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet SettingsActivitiesTwitterproiedev.comAction1]
"Context"="document"
"HasPreview"=dword:00000001

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet SettingsActivitiesTwitterproiedev.comAction1execute]
"Action"="http://examples.proiedev.com/04/twitter/service.php"
"Method"="post"
"Enctype"="application/x-www-form-urlencoded"
"Accept-charset"="utf-8"
"ParamCount"=dword:00000004

[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet SettingsActivitiesTwitterproiedev.comAction1executeParameter1]
"Name"="mode"
"Value"="execute"
"Type"="text"

...

Accelerators specify a category in their XML definition that best describes their activity. The default Accelerator for each category is chosen either by the user through web-based installation and Manage Add-Ons, or by a binary application run under user consent. If an Accelerator is installed as a default service provider, or if it is the only Accelerator in a given category, it will be shown on the top level of its context menu; otherwise, it will be in the second-level Accelerator submenu (see Figure 4-9).

Figure 4.9. The Accelerator menus

The lack of a fixed set of categories lends itself to abuse. Accelerators can "automatically" become a default provider and earn better placement by creating unique category names. Although the results are tempting, developers must avoid creating unique categories for every Accelerator offered. Not only does this add to clutter in a user's context menu, too many Accelerators may turn off users to a brand. Since Manage Add-Ons offers an easy way for users to remove them, Accelerators for a specific brand can easily be uninstalled if they provoke a user to do so.

Accelerators can be upgraded in the same way they are installed—using the AddService() method. Instead of being given a standard installation dialog, users are asked if they wish to replace the existing Accelerator, as shown in Figure 4-12.

Figure 4.12. The Accelerator replacement and upgrade dialog

There is no automatic, push-down mechanism whereby a web service can upgrade previously installed Accelerators. Accelerators can, however, be designed to pass a version number to a web service via a <parameter> tag. Users can then be prompted to upgrade an Accelerator from that service.

Listing 4-19 shows an Accelerator that passes version information to its web service. On receipt of the version variable, a web service may return a notice to a user that an upgrade is necessary through the preview window or the target page.

...
    <activityAction context="selection">
        <execute
          action="http://examples.proiedev.com/book/examples/flip/flip.html"
          method="get">
            <parameter name="t" value="{selection}" type="text" />
            <parameter name="version" value="1.0" type="text" />
        </execute>
    </activityAction>
    ...

Accelerators don't need to defer to a new window or even implement the execute method in their definition. Preview windows can be used to create rich experiences without the need to navigate to a web service. Figure 4-13 demonstrates an Accelerator called the WOT Reputation Scorecard, and an extension that uses APIs provided by the Web-of-Trust link reputation service. This Accelerator allows users to learn the reputation of a URL before navigating to it.

Figure 4.13. The WOT Reputation Scorecard Accelerator

Listing 4-20 shows the XML definition for this Accelerator. For each context, the only method is available is preview, which routes link information back to a web service. There is no execute method.

<?xml version="1.0" encoding="UTF-8" ?>
<os:openServiceDescription
   xmlns:os="http://www.microsoft.com/schemas/openservicedescription/1.0">
   <os:homepageUrl>http://examples.proiedev.com/04/advanced/mixed/</os:homepageUrl>
   <os:display>
      <os:name>WOT Reputation Scorecard</os:name>
      <os:icon>http://examples.proiedev.com/04/advanced/mixed/favicon.ico</os:icon>
      <os:description>The WOT community has rated millions of websites.
         Use their warnings to protect yourself from online scams, sites
         with adult content and spam.
      </os:description>
   </os:display>
   <os:activity category="Safety">
      ...
      <os:activityAction context="link">
         <os:preview
            action="http://examples.proiedev.com/04/advanced/mixed/service.php" k
            method="post">
            <os:parameter name="mode" value="document" type="preview" />
            <os:parameter name="type" value="document" type="link" />
            <os:parameter name="documentDomain" value="{documentDomain}" type="text" />
            <os:parameter name="linkDomain" value="{linkDomain}" type="text" />
         </os:preview>
      </os:activityAction>
   </os:activity>
</os:openServiceDescription>

Listing 4-21 is the web service for this Accelerator. Unlike the Tweet This! example, the main focus of this page is to display content in the preview window without navigating to a web service.

<html>
   <head>
      <meta http-equiv="X-UA-Compatible" content="IE=edge">
      <meta http-equiv="Pragma" content="no-cache">
      <title>WOT URL Reputation Service</title>
                <link type="text/css" rel="stylesheet" href="styles/preview.css">
   </head>
   <body topmargin="0" leftmargin="0">
      <div id="logo"><img src="images/logo.png" width="100px" height="38px"></div>
      <table border="0" cellpadding="0" cellspacing="0" align="center">
         <thead>
            <tr>
               <td width="71px" colspan="2" align="center">Tenet</td>
               <td width="171px" colspan="3" align="center">Reputation</td>
            </tr>
         </thead>
         <tbody>
            <? foreach($components as $k => $v) { ?>
            <tr>
               <td width="16px"><img src="images/<? echo(getReputationIcon($k)); ?>"></td>
               <td width="55px"><? echo(getComponentName($k)); ?></td>
               <td width="100px" class="testimony"><img src="images/marker.png"
                  style="margin-left: <? echo(getMarkerPos($k)); ?>px;"></td>
               <td width="20px"><? echo(getReputationValue($k)); ?>%</td>
               <td width="51px"><img src="images/<? echo(getConfidenceIcon($k)); ?>"></td>
            </tr>
            <? } ?>
         </tbody>
      </table>
   </body>
</html>

When this service receives link information, it queries the WOT API for information on that link. It uses the preview window to format the results of this API call into content consumable by an end user.

The OpenService schema does not provide for the built-in localization of Accelerators. Developers may localize Accelerators by creating an XML definition for each supported language. Listings 4-22 and 4-23 show an Accelerator localized in English and Spanish, respectively.

<?xml version="1.0" encoding="UTF-8" ?>
<os:openServiceDescription
   xmlns:os="http://www.microsoft.com/schemas/openservicedescription/1.0">
   <os:homepageUrl>http://examples.proiedev.com/04/basic/xmlservice/</os:homepageUrl>
   <os:display>
      <os:name>Tweet This!</os:name>
      <os:icon>http://examples.proiedev.com/04/basic/xmlservice/favicon.ico</os:icon>

<os:description>
         Share and discover what's happening right now,
         anywhere in the world.
      </os:description>
...

<?xml version="1.0" encoding="UTF-8" ?>
<os:openServiceDescription
   xmlns:os="http://www.microsoft.com/schemas/openservicedescription/1.0">
   <os:homepageUrl>http://examples.proiedev.com/04/basic/xmlservice/</os:homepageUrl>
   <os:display>
      <os:name>¡Publique su selección con Twitter!</os:name>
      <os:icon>http://examples.proiedev.com/04/basic/xmlservice/favicon.ico</os:icon>
      <os:description>
         Comparte y descubre qué está pasando ahora mismo
         en cualquier lugar del mundo.
      </os:description>
...

A localized Accelerator may point to a localized web service. A variable can be passed to a web service indicating a desired localization for that service. Listing 4-24 is an example of this—a service receives a locale parameter that it can use to render the page—in this case, en-us for US English.

...
<activityAction context="selection">
   <execute
      action="http://examples.proiedev.com/book/examples/flip/flip.html"
      method="get">
      <parameter name="t" value="{selection}" type="text" />
      <parameter name="version" value="1.0" type="text" />
      <parameter name="locale" value="en-us" type="text" />
   </execute>
</activityAction>
...

Other applications and browsers are free to use the Accelerator model in their platforms under the Creative Commons license. While no browsers have implemented Accelerators as of this book's publication, a Firefox add-on is available. Michael Kaply's IE8 Accelerators for Firefox places Accelerators into the Firefox context menu in the same way as IE. It can be downloaded from the Firefox Add-Ons site (http://addons.mozilla.org).

Users are provided with Accelerator information—its name, description, category, and so on—during the installation process and later on through the Manage Add-Ons interface (see Figure 4-14). This metadata is defined in the XML definition file for each Accelerator.

Figure 4.14. Accelerator information pane in Manage Add-Ons

Providing relevant information allows users to make informed decisions about Accelerators and stay in control of their browsing experience.

Security is an important aspect of Accelerator design. Accelerators offer users and developers a new way of associating web content to web services, but along with this comes an increased attack surface. Developers must take a careful look at what data will be sent to a web service and how that web service handles data—this includes controlling how data is integrated into a web service. Thorough planning can prevent malicious activity such as script injection and denial-of-service attacks.

To protect users from denial-of-service and drive-by attacks, the web browser instance shown in preview mode places limits on active content. ActiveX controls can run, but the controls must be already installed and approved to run on the service's domain before they can be used by the preview; no information bar will be shown.

Developers must also be mindful of script injection attacks when designing Accelerators. An example of this form of attack is shown in Listing 4-25, in which the script is sent through a GET variable.

http://www.example.com/action.php?t=%3Cscript%3Ealert(%22Pwnd.%22)%3B%3C%2Fscript%3E

Other forms of XSS attacks, such as DOM-based and persistent script injection via GET and POST variables, are not mitigated by the browser. Despite built-in protections such as IE's XSS filter and Firefox's NoScript extension, it's always a good idea to sanitize input of variables from an Accelerator (or other input methods). Client-side Accelerator code may use the window.toStaticHTML() sanitization method in IE 8 to mitigate against script injection. When using server-side languages such as PHP, Ruby, and ASP.NET, developers should take advantages of built-in or library-based sanitization functions before rendering untrusted input. The Microsoft Anti-XSS library is a great starting point for developers looking to help fight against this problem.

Performance of web pages belonging to a service can also impact the experience of using an Accelerator. IE allows users to determine their own tolerance for slow controls by displaying a "Loading . . ." screen during an Accelerator's loading process. Fast-loading pages will avoid such an experience. Tooling applications like the IE Developer Tools, Fiddler, and Firebug can be used to ensure page load time is kept to a minimum.

The preview window is 320 pixels in width by 240 pixels in height on a 96-dots-per-inch (dpi) display. Any content rendered in the preview pane will be trimmed to this size; scrollbars are disabled as well.

High DPI mode (120 or 144 dpi) should be considered when creating Accelerators. When IE is running in High DPI mode, the preview windows will be expanded by appropriate measure (e.g., 120 percent for 120 dpi).

The following checklist highlights some best practices developers can use to design, build, and deploy quality Accelerators: