HTML Help Builder
Alternative chm viewer
Gravatar is a globally recognized avatar based on your email address. Alternative chm viewer
  Kelvin Smith
  All
  Nov 17, 2021 @ 04:28pm

I'm using HTML Help Builder for context-sensitive help for a Visual Studio 2019 application. It's worked very well for a number of years. However, a new situation has come up for how we're using it.

Our software previously was just installed on Windows. We're now providing it using AWS AppStream, which operates as a Windows VM in the cloud. We want to strictly control what people can do in the VM; since we're paying for the computer time, we don't want someone to start mining bitcoin rather than running our software. The Help Builder help messages are displayed using the standard Windows HTML Help application. Unfortunately, that application has a security hole: The control box has an option "Jump to URL:", which allows the user to open any website, and it's relatively simple from that point to download an application which can do anything.

To eliminate the security risk, we're thinking we need to get a different application to display the .chm output of Help Builder. However, I'm having a hard time finding something that will display the pages properly and respond to the context ID as shown in the HelpKeyword. Do you have any suggestions for an alternative?

I'm currently using HTML Help Builder v4.68, though I'm willing to upgrade to v5 if that will make a difference for this issue.

Gravatar is a globally recognized avatar based on your email address. re: Alternative chm viewer
  Rick Strahl
  Kelvin Smith
  Nov 17, 2021 @ 05:45pm

There's no such thing as far as I know. Microsoft quit supporting CHM sometime around 2010 with many new help formats that were crazy complex and had little uptake that followed.

I actually started building a viewer a long time ago with the goal for .NET integration, but never finished it. Either way though it wouldn't work with integration in FoxPro because the CHM handling there is internal and can't be directly intercepted. I've built something custom with F1 key handling and looking for the active control, the walking up the control tree to get the context id and opening a browser window instead. It works, and is a good compromise without being stuck with the outdated CHM viewer and its security issues.

+++ Rick ---

Gravatar is a globally recognized avatar based on your email address. re: Alternative chm viewer
  Kelvin Smith
  Rick Strahl
  Nov 18, 2021 @ 12:06pm

Thanks, Rick. Upon more research, it looks like I can use Internet Explorer Enhanced Security Configuration and Group Policy to lock down the system and prevent access to the Internet. So I think I can stick with MS's HTML Help Viewer after all.

© 1996-2021