Adobe FLEX 2-PROGRAMMING ACTIONSCRIPT 3.0 Manual page 449

17
CHAPTER 17
Flash Player Security
Security is a key concern of Adobe, users, website owners, and content developers. For this
reason, Adobe Flash Player 9 includes a set of security rules and controls to safeguard the user,
website owner, and content developer. This chapter discusses how to work with the Flash
Player security model when you are developing Flash applications. In this chapter, all SWF
files discussed are assumed to be published with ActionScript 3.0 (and thus running in Flash
Player 9 or later), unless otherwise noted.
This chapter is intended as an overview of security; it does not try to comprehensively explain
all implementation details, usage scenarios, or ramifications for using certain APIs. For a more
detailed discussion of Flash Player Security concepts, see the Flash Player 9 Security white
paper, at www.adobe.com/go/fp9_0_security.
Contents
Flash Player Security overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 450
Overview of permission controls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 452
Security sandboxes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 461
Restricting networking APIs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 464
Full-screen mode security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .465
Loading content . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 467
Cross-scripting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .470
Accessing loaded media as data. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .474
Loading data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 477
Loading embedded content from SWF files imported into a security domain . . .479
Working with legacy content . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 480
Setting LocalConnection permissions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 481
Controlling access to scripts in a host web page. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 481
Shared objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .483
Camera, microphone, Clipboard, mouse, and keyboard access . . . . . . . . . . . . . . .484
449