COM Add-ins and Security

Article
09/14/2006

You can specify security settings for Microsoft® Office XP applications in the Office XP Security dialog box, available by pointing to Macro on the Tools menu and then clicking Security. The Security Level tab includes a check box, Trust all installed add-ins and templates. If this box is selected, Office XP applications will load all COM add-ins, application-specific add-ins, and templates in trusted folders without checking to see whether they have valid digital signatures from trusted sources.

If this check box is not selected, the Office XP application checks to see whether the add-in or template has been signed digitally by a trusted source before loading it. If it has, the add-in will be loaded under any security level. If it has not been signed, if it has not been signed by a trusted source, or if the signature has been invalidated, the add-in will not load under high security. Under medium security, users will be warned that the add-in might not be safe. Under low security, the add-in will load and run without prompting the user.

To digitally sign a COM add-in DLL, you must obtain a digital certificate from a certificate authority, and you must run the Signcode.exe utility included with the Microsoft Internet Client Software Development Kit (SDK) on the COM add-in DLL. A digital certificate identifies the developer of a component as a trusted source. For more information about digitally signing a DLL, search the Microsoft Developer Network (MSDN®) Web site, at https://msdn.microsoft.com/, for "digital signing."

You can use the COMAddIn object and the COMAddIns collection to control COM add-ins from Microsoft® Visual Basic® for Applications (VBA) code that is running within the host application. For example, you can load an add-in programmatically when a user clicks a button to access a particular feature; or, you can load an add-in from VBA when you open an application through Automation.

The Office XP object library supplies the COMAddIn object and the COMAddIns collection. The Application object for each Office XP application — Microsoft® Word, Microsoft® Excel, Microsoft® PowerPoint®, Microsoft® Access, Microsoft® FrontPage®, and Microsoft® Outlook® — has a COMAddIns property, which returns a reference to the COMAddIns collection. For any application, the COMAddIns collection contains only those COM add-ins that are registered for that application. The COMAddIns collection in Excel, for example, contains no information about COMAddIn objects in Word.

The Connect property of a COMAddIn object sets or returns the load status of the add-in. Setting this property to True loads the add-in, while setting it to False unloads it.

The ProgId property returns the name of the registry subkey that stores information about the COM add-in. The registry subkey takes its name from the COM add-in's programmatic identifier, which consists of the name of the Add-in project followed by the name of the add-in designer or class module that is actually supplying the add-in for a particular application. For example, when it is properly registered, the Image Gallery sample add-in for Excel has the following value for its ProgId property:

ImageGallery.dsrImageExcel

The name of the Add-in project is ImageGallery, and the name of the add-in designer for the Excel version of the add-in is dsrImageExcel.

You can use an add-in's ProgId property value to return a reference to the add-in from the COMAddIns collection, as shown in the following code fragment, which prints the current value of the Excel Image Gallery COM add-in's Connect property:

Debug.Print Excel.Application.COMAddIns("ImageGallery.dsrImageExcel").Connect

You can use the COMAddIn object and COMAddIns collection to get information about available COM add-ins from code running in an Office XP application. You can also use it to load and unload add-ins from code running in the add-in host application, or from code that is performing an Automation operation on the host application from another application.

If you are concerned about the performance of your application, you might want to load an add-in only at certain times. You can control this by loading and unloading it through VBA code.

The following code uses Automation to launch Word from another application, such as Excel, and load the Image Gallery add-in. To run this code from another application, remember to first set a reference to the Word object library.

Function LoadWordWithImageGallery() As Boolean
   ' Loads Word and connects Image Gallery add-in.
   ' If Image Gallery add-in is not available, procedure
   ' fails silently and returns False.
   
   Dim wdApp         As Word.Application
   Dim cmAddIn      As Office.COMAddIn
   
   ' Create instance of Word and make visible.
   Set wdApp = New Word.Application
   wdApp.Visible = True
   
   ' Return reference to COM add-in, checking for error
   ' in case it doesn't exist.
   On Error Resume Next
   ' Set reference to COM add-in by using its ProgId property value.
   Set cmAddIn = wdApp.COMAddIns("ImageGallery.dsrImageWord")
   If Err.Number = 0 Then
      ' Connect add-in.
      cmAddIn.Connect = True
      ' Perform other operations here.
      ' .
      ' .
      ' .
      LoadWordWithAddIn = True
   Else
      ' Return False if error occurred.
      LoadWordWithAddIn = False
   End If
   
   ' Enter break mode here to verify that add-in is loaded.
   Stop
   
   ' Quit Word.
   wdApp.Quit
   Set wdApp = Nothing
End Function

COM Add-ins and Security

See Also

Additional resources