Appendix 1: Internet Explorer 6 to Internet Explorer 9 Browser Changes

Internet Explorer Versioning

• When a long user agent (UA) string encounters a server that accepts shorter UA string only, the user will be presented with an error page.
  
  

• Internet Explorer 8 Compatibility View mode, turned on by default for intranet sites in Internet Explorer 8, actually sends an Internet Explorer 7 user agent string; to differentiate between Internet Explorer 7 and Compatibility View, look for the new Trident token.
  
  

• Check for code that incorrectly creates a special case for Internet Explorer, Internet Explorer 8, or Internet Explorer 9 by using user agent (UA) string sniffing, version vectors, or conditional comments.
  
  
• Internet Explorer 9 sends a short UA string by default, without pre- and post-platform registry value tokens.
  
  
• Compatibility View mode, turned on by default for intranet sites in Internet Explorer 8, actually sends an Internet Explorer 7 user agent string; to differentiate between Internet Explorer 7 and Compatibility View in Internet Explorer 8, look for the Trident 5.0 token.
  
  

Standards Compliance Updates

• Applies to specified document modes.
  
  
• IE8 Compatibility View mode, on by default for intranet, generally reverts standards updates from IE7 to IE8.
  
  
• Use the EmulateIE7 X-UA-Compatible HTTP header or META tag to enable Compatibility View mode on websites or specific pages.
  
  

Applies to Internet Explorer 7 Standards or “Strict” mode and above:

• XML prologs in first line of source code no longer cause DOCTYPE declarations to fail.
  
  
• Box model overflow content now intersects box, no longer auto-grows box div to fit content.
  
  
• Certain CSS filters (for example, *HTML, _underscore, and /**/ comment) are no longer supported.
  
  
• Only outermost OBJECT in nested objects is instantiated.
  
  
• Applications that relied on SELECT element to get an HWND to use with Microsoft Win32 APIs may break because SELECT element is now a windowless control.
  
  
• Channel Definition Format (CDF) is no longer supported, in favor of RSS feeds.
  
  
• XBM, an imaging format designed for X-based systems, is no longer supported.
  
  
• BASE tags outside of the HEAD document are no longer allowed.
  
  

Applies to Internet Explorer 8 Standards mode and above:

• Unclosed P elements are now automatically closed when followed by TABLE, FORM, NOFRAMES, or NOSCRIPT elements.
  
  
• Malformed HTML is no longer supported, in favor of well-formed, valid markup.
  
  
• “className” attribute syntax no longer supported, in favor of “class” syntax.
  
  
• The attributes collection no longer contains all possible attributes recognized by Internet Explorer.
  
  
• Attribute ordering has changed, affecting attributes collection, innerHTML, and outerHTML.
  
  
• GetElementById is case sensitive and no longer searches name attributes.
  
  
• Generic CSS prefix selectors (that is, v\:* syntax) no longer supported, in favor of explicit tag names.
  
  
• CSS expressions no longer supported, in favor of improved CSS support or DHTML logic.
  
  
• Code intended for custom JSON object methods may conflict with IE8’s new native JSON object.
  
  
• Unset properties on the currentStyle object now return their initial value. This is the root cause of issues with the ASP.NET menu control (example).
  
  
• Unset properties values on the style object now return empty string.
  
  

Applies to Internet Explorer 9 Standards mode and above:

• Internet Explorer 9 does not recognize angle brackets (<>) within the createElement method.
  
  
• OBJECT fallback is not included in DOM and matched by window[name].
  
  
• arguments.caller property is not supported in Internet Explorer 9 standards mode.
  
  
• Automatic binding of binary element behaviors does not work.
  
  
• Calling a method with a function pointer without “.call”, or “.bind” is no longer supported.
  
  
• Content attributes and DOM expandos are no longer connected.
  
  
• APIs are not available if iFrame is removed from DOM tree.
  
  
• Dynamic VML patterns may not work – the VML behavior must be attached to an element before any VML properties are assigned.
  
  
• Thai and East Asian text and font sizing may appear smaller than other typefaces.
  
  
• Indirect ‘eval’ function calls behave differently.
  
  
• Overlapping formatting elements are cloned to reduce ambiguity in the DOM.
  
  
• Some behavior-connecting methods do not work in XML mode.
  
  
• styleSheet.title is readonly in Internet Explorer.
  
  
• Table object mode is now more consistent with other browsers.
  
  
• Text layout uses natural metrics instead of Graphics Device Interface (GDI) metrics.
  
  
• White spaces are preserved in the DOM.
  
  
• Some DOM events are deprecated in favor of more standards-compliant events.
  
  

For more information about other changes, see Web Applications and Standards/Interop Improvements on these posts.

Applies to all document modes in Internet Explorer 9:

• Array elements with large indices are handled differently.
  
  
• JavaScript properties may be enumerated differently from how they were enumerated in Internet Explorer 8.
  
  
• Math precision differs in Internet Explorer 9.
  
  

Security Improvements

• Apply regardless of document mode.
  
  
• Security features can be turned off using Group Policy.
  
  

• window.opener trick used to bypass the window.close prompt is no longer allowed.
  
  
• Object caching protection is enabled by default, which blocks access to references of objects when users browse to a new domain (applies to Internet Explorer 6 and later on Windows XP Service Pack 2 and later).
  
  
• DHTML scriptlets are now disabled by default.
  
  
• Scripts that write to the status bar are now blocked.
  
  
• URL creation may fail if URLs do not meet RFC guidelines.
  
  
• HTTPS pages will display an error page if site is configured to SSLv2 only, or if site security certificate is outdated, invalid, has errors, or has weak ciphers.
  
  
• Only “punycode” encoded internationalized domain names are supported; other formats like ANSI and UTF-8 are now blocked.
  
  
• Cross-domain script URLs, redirected navigation in DOM objects, and frame navigations are now blocked.
  
  
• Modal or modeless dialogs created from script might seem slightly bigger.
  
  
• Unsecure protocols view-source, Gopher (at the WinINET level), and Telnet no longer work.
  
  

• XSS filter is on by default. This blocks script patterns that most frequently resemble Type-1 XSS attacks, unless disabled by site developer through X-XSS-Protection HTTP header.
  
  
• Cross-domain, cross-document communication hacks like SCRIPT SRC are no longer supported, in favor of safer XDM and XDR AJAX features.
  
  
• AJAX-enabled sites that manually manipulate the hash of the URL may be broken by the new window.location.hash navigation property.
  
  
• New AJAX features like XDM have native properties that may conflict with existing custom properties.
  
  
• File upload control only submits the file path, not the full path, to the server.
  
  
• HTML or script delivered with an “image/*” MIME type is blocked from executing.
  
  
• Navigating a top-level frame to a site in a different security context opens a new window or tab instead of navigating within the existing frame.
  
  
• UTF-7 encoded script is forced into Windows-1252 encoding, which may cause plain text rendering.
  
  
• HTTP/HTTPS “mixed mode” pages display a dialog that defaults to displaying secure items only (as opposed to the previous nonsecure default); users may mistakenly choose to block HTTP elements, like key images.
  
  
• DEP/NX is on by default, blocking certain add-ons (that is, ActiveX® controls and COM objects) built with older versions of ATL from running code marked “non-executable” in memory.
  
  
• Content returned by a web proxy if an SSL tunnel is not established in response to a CONNECT request to the original server is blocked.
  
  

• Style sheets are ignored unless they are delivered with the text/css MIME type.
  
  
• HTML documents delivered with a text/plain MIME type render or download as plain text only and are not MIME-sniffed to another type.
  
  
• SCRIPT and STYLESHEET elements reject responses with incorrect MIME types if the server sends the response header X-Content-Type-Options: nosniff.
  
  

See other security updates in the Security sections of these blog posts:

• Internet Explorer 9 Beta minor change list
  
  
• Internet Explorer 9 Release Candidate minor change list
  
  

Architectural Changes

• Apply regardless of document or compatibility mode.
  
  

• Protected Mode, also a key security feature, is enabled by default for Internet, Intranet, and Restricted Sites zones. This blocks browser extensions that could pose a security risk from running and lower privilege applications from accessing higher privilege processes (applies to Internet Explorer 7 and later on Windows Vista® and later).
  
  

• Protected Mode Update: Intranet now runs in medium (instead of low) integrity level by default.
  
  
• Loosely Coupled IE may block add-ons (that is, ActiveX controls and COM objects) that: 1) Use windows hierarchy techniques to locate UI frame and tab windows (which now run in separate processes at different integrity levels), 2) Create a subclass of the UI frame (now at medium integrity level) from a low-integrity tab process, 3) Use unsupported messaging techniques between UI frame and tabs.