MarkOfTheWeb Class

Namespace: Meziantou.Framework.Win32
Assembly: Meziantou.Framework.Win32.MarkOfTheWeb.dll
Package: Meziantou.Framework.Win32.MarkOfTheWeb 2.0.9
Source: MarkOfTheWeb.cs
Available in package assets: net10.0net11.0

Supported on windows

Provides methods to interact with the Mark of the Web (MOTW) security feature in Windows. MOTW helps protect users from potentially unsafe content downloaded from the internet by storing the origin zone information in an Alternate Data Stream (ADS) named "Zone.Identifier".

[SupportedOSPlatform("windows")]
public static class MarkOfTheWeb

Example

Add, read, and remove the Mark of the Web of a file:

var path = Path.GetTempFileName();

// Add the Mark of the Web to a file
MarkOfTheWeb.SetFileZone(path, UrlZone.Internet);

// Get the zone of a file
var zone = MarkOfTheWeb.GetFileZone(path);
Assert.Equal(UrlZone.Internet, zone);

// Remove the Mark of the Web from a file
MarkOfTheWeb.RemoveFileZone(path);
Assert.Null(MarkOfTheWeb.GetFileZoneContent(path));

Methods

Name	Description
GetFileZone(string)	Gets the security zone of a file using the Windows Security Manager COM API.
GetFileZoneContent(string)	Gets the raw content of the Zone.Identifier alternate data stream from a file.
GetFileZoneIdentifier(string)	Gets the zone information stored in the Zone.Identifier alternate data stream of a file.
IsUntrusted(string)	Determines whether a file is from an untrusted source based on its security zone. Files outside of the Local Machine, Trusted, and Intranet zones are considered untrusted.
RemoveFileZone(string)	Removes the Mark of the Web zone information from a file by deleting the Zone.Identifier alternate data stream.
SetFileZone(string, UrlZone, string?, string?)	Sets the Mark of the Web zone information for a file by writing to the Zone.Identifier alternate data stream.

GetFileZone(string)

MarkOfTheWeb.cs

Gets the security zone of a file using the Windows Security Manager COM API.

public static UrlZone GetFileZone(string filePath)

Parameters

filePath string: The path to the file to query.

Returns

UrlZone The UrlZone of the file, or UrlZone.Invalid if the zone cannot be determined. Windows can also report a custom zone, numbered 1000 and above, that has no named UrlZone member.

GetFileZoneContent(string)

MarkOfTheWeb.cs

Gets the raw content of the Zone.Identifier alternate data stream from a file.

public static string? GetFileZoneContent(string filePath)

Parameters

filePath string: The path to the file to read.

Returns

string? The content of the Zone.Identifier stream, or null if the file does not have zone information, or if the file or its directory does not exist.

Remarks

Windows and web browsers write the stream as ASCII. A byte order mark, if present, takes precedence, so streams written as UTF-16 by earlier versions of this library are still decoded correctly.

GetFileZoneIdentifier(string)

MarkOfTheWeb.cs

Gets the zone information stored in the Zone.Identifier alternate data stream of a file.

public static ZoneIdentifier? GetFileZoneIdentifier(string filePath)

Parameters

filePath string: The path to the file to read.

Returns

ZoneIdentifier? The parsed content of the Zone.Identifier stream, or null if the file does not have zone information, or if the file or its directory does not exist.

Remarks

This reports what the stream records, not the zone Windows assigns to the file. Use MarkOfTheWeb.GetFileZone or MarkOfTheWeb.IsUntrusted to make a security decision.

IsUntrusted(string)

MarkOfTheWeb.cs

Determines whether a file is from an untrusted source based on its security zone. Files outside of the Local Machine, Trusted, and Intranet zones are considered untrusted.

public static bool IsUntrusted(string filePath)

Parameters

filePath string: The path to the file to check.

Returns

bool true if the file is from an untrusted zone (Internet or Restricted), or if Windows cannot evaluate its zone; otherwise, false.

Exceptions

FileNotFoundException: filePath does not point to an existing file. A directory is not a file.

RemoveFileZone(string)

MarkOfTheWeb.cs

Removes the Mark of the Web zone information from a file by deleting the Zone.Identifier alternate data stream.

public static void RemoveFileZone(string filePath)

Parameters

filePath string: The path to the file from which to remove the zone information.

Remarks

Does nothing when the file carries no zone information, or when the file or its directory does not exist. The zone information of a read-only file is removed too, and the file stays read-only.

SetFileZone(string, UrlZone, string?, string?)

MarkOfTheWeb.cs

Sets the Mark of the Web zone information for a file by writing to the Zone.Identifier alternate data stream.

public static void SetFileZone(string filePath, UrlZone zone, string? referrerUrl = null, string? hostUrl = null)

Parameters

filePath string: The path to the file to mark.
zone UrlZone: The security zone to assign to the file.
referrerUrl string?: Optional URL of the page that linked to the file. An empty string is treated as no URL.
hostUrl string?: Optional URL of the host from which the file was downloaded. An empty string is treated as no URL.

Exceptions

ArgumentOutOfRangeException: zone is not one of UrlZone.LocalMachine, UrlZone.Intranet, UrlZone.Trusted, UrlZone.Internet, or UrlZone.Untrusted.
ArgumentException: referrerUrl or hostUrl contains a carriage return, a line feed, or a null character.
FileNotFoundException: filePath does not point to an existing file. A directory is not a file.

Remarks

The zone information of a read-only file is set too, and the file stays read-only.