Security
While bypassing the Security Patch to allow for an unrestricted access to the Outlook objects, Redemption does provide several layers of security to help you minimize a change of a rogue code using taking advantage of Redemption.
Using AuthKey property. Once AuthKey property is set to some value, all Redemption objects must set AuthKey property to the same value before any other properties can be used:
|
Dim sContact, oContact
set sContact = CreateObject("Redemption.SafeContactItem") sContact.AuthKey = "SecretKey" set oContact = Application.Session.GetDefaultFolder(10).Items(1) sContact.Item = oContact MsgBox sContact.Email1Address |
If you want to change the value of the AuthKey property, you need to first set it to the old value (so that Redemption knows that you are a legitimate user), then reset it to a new value. Or you can delete HKCU\Redemption registry key (note a couple funny looking characters - Redemption uses a Unicode name to make the key inaccessible to the scripts). The registry keys contain hashes of the paths to either original or customized copies of Redemption.dll and hashes of the authentication keys; since only hashes are stored, there is no way to deduct the real values of the dll paths and authentication keys.
|
Dim sContact, oContact
|
Create a truly custom version of Redemption with custom class names and GUIDs. Distributable version of Redemption comes with a customization tool (customize.exe) that lets you create a custom copy of Redemption (it is not available in the demo version). AuthKey property (see above) will only apply to your copy of Redemption: your code will not be affected by other instances of the Redemption library installed by other applications, as well as other applications will not even be aware of your customized version of Redemption.

Custom
versions of Redemption are guaranteed not to interact with other instances
of Redemption, either original or custom. Creating a custom version of
Redemption along with using the AuthKey property significantly reduces a
chance of malicious code using Redemption.
Note that to use a custom version of Redemption, your VB code must use CreateObject() function rather than New.
E.g. the code like
|
Dim sItem as Redemption.SafeMailItem |
|
Dim sItem as Redemption.SafeMailItem |
On the
low level, in the first example VB hardcodes the class GUID of
Redemption.SafeMailItem and if you modify the dll name and/or class name the
second line will fail.
If you
use the second example, VB does not hardcode the class GUID. I.e. you still
dim your variable as Redemption.SafeMailItem (since it is only used at
design time by VB), but to create an instance of the object, you must
specify the modified class name ("MyDll.MyMailItem")
If you
are using C++, this means that you need to either use CoCreateInstance() passing
the modified class GUID or call CLSIDFromProgID() to obtain the
(modified) class GUID, then call CoCreateInstance() In case of C# or other .Net languages, you can use the code similar to
that given below (it is assumed that you have already created the interop
DLL):
Type t = Type.GetTypeFromProgID("MyDll.MyMailItem"); Note: Redemption installs itself as an Exchange Client
Extension (ECE) for the performance reasons (it retrieves IMAPISession
directly from Outlook for use by the Safe*Item objects). If your code runs
outside the outlook.exe process (i.e. it is not an Outlook COM add-in), you
will not benefit from Redemption being an ECE. In such a case, you can turn
the ECE functionality off by un-checking the ""Install Redemption as an
Exchange Client Extension" checkbox (see step 4 on the screenshot above). An
additional benefit is that you will be able to replace the dll even if
Outlook is running since it only loads Redemption.dll if Redemption is
installed as an ECE.
SafeMailItem sItem = (SafeMailItem) Activator.CreateInstance(t);
Use Registry-free COM (Windows XP or later) (See "Creating Registration-Free COM Objects" on MSDN and "Simplify App Deployment with ClickOnce and Registration-Free COM" in MSDN Magazine). Windows XP allows COM objects to be used without requiring that they be registered. If your application uses a manifest file, you can request that you want Windows to load the specified COM objects from the directory where your executable resides rather than query the registry for the location of the COM library.
To use this feature add (or modify) the manifest file and provide the following (bolded) entries. Note that registry-free COM can be used with other methods discussed above
|
<?xml version="1.0" encoding="utf-8"?> |