ShellExecute blocks (never returns) when firewall denies internet access

Question

I've been using ShellExecute to open URLs in a browser, invoked from a modal windows' code, like this:

procedure TfmAbout1.BtnHomePageClick(Sender: TObject);
begin
   inherited;
   if ConnectedToWeb then
    ShellExecute(Handle, 'open', URL_PRODUCT_HOMEPAGE, nil, nil, SW_SHOWNORMAL);
end;

But on machines with the Zone Alarm firewall, the user may get a pop-up prompt to allow or deny my application access to the Internet. When the user clicks "Deny", then ShellExecute never returns... my application is then hung & the process has to be shut down externally (i.e., from Task Manager).

What can I do to either anticipate or prevent this? I need something like a ShellExecute that is non-blocking in this situation.

I'd appreciate any ideas.

I suspect it's really ConnectedToWeb that has the problem. ShellExecute shouldn't request network access; it just runs whatever is associated with the "http" prefix in the registry. Zone Alarm flags your program because it's attempting the access the Internet in order to determine whether the Internet is accessible. If your program doesn't actually need Internet access, then you're just making things worse because even if Zone Alarm allows a browser to have access, it might deny your program, and so your function returns incorrect results. Call ShellExecute unconditionally. — Rob Kennedy
@Rob - I'd already thought of that. ConnectedToWeb is not the problem. Commenting it out shows that the ShellExecute call is what blocks. By the way, Zone Alarm reports: [My appname] executable is trying to access "goflagship.com". I'm putting out other fires at the moment, but will reply back when I have a solution worked out (most likely calling ShellExecute via a separate thread or separate process that can be killed). Another thought: I'm going to try to see if I can ping the web site, with a timeout, as a more graceful solution. — Mark Wilsdorf
(I didn't get the link entered properly in prior comment. ZoneAlarm actually reports the full URL including http:// — Mark Wilsdorf
@Warren: From the customers' --yes, plural customers--PCs? Obviously, that won't work on broadly marketed commercial software, which must even "fix" (protect itself from problems on) the customer's PC or risk being seen as buggy itself, when it's some other app that's causing problems.<g> — Mark Wilsdorf

Jeroen Wiert Pluimers Jeroen Wiert Pluimers · Accepted Answer · 2011-05-02T06:50:08

So you want to work around a bug in Zone Alarm?

I'd probably check for the Zone Alarm version, and depending on it, have a small 'bootstrap' program perform the ShellExecute on my behalf. That would only hang the small bootstrap program.

You could kill that bootstrap program (since your parent process is the owner) if it hasn't returned after a time out (15 or 30 seconds would do).

You could even warn the user that is has a buggy version of Zone Alarm :)

Edit: Note: I think killing a process is safer than killing a thread.

ShellExecute blocks (never returns) when firewall denies internet access

2 Answers