Restricting Networking Apis - Adobe FLEX 2-PROGRAMMING ACTIONSCRIPT 3.0 Manual

Restricting networking APIs

You can control a SWF file's access to network functionality by setting the
parameter in the
<object>
content.
Possible values of
allowNetworking
(the default)—All networking APIs are permitted in the SWF.
■ "all"
—The SWF file may not call browser navigation or browser interaction APIs,
"internal"
■
listed later in this section, but it may call any other networking APIs.
—The SWF file may not call browser navigation or browser interaction APIs,
"none"
■
listed later in this section, and it cannot use any SWF-to-SWF communication APIs, also
listed later.
Calling a prevented API throws a SecurityError exception.
To set the
allowNetworking
page that contains a reference the SWF file, add the
value, as shown in the following example:
<object classid="clsid:d27cdb6e-ae6d-11cf-96b8-444553540000"
codebase="http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/
swflash.cab#version=9,0,18,0"
width="600" height="400" id="test" align="middle">
<param name="allowNetworking" value="none" />
<param name="movie" value="test.swf" />
<param name="bgcolor" value="#333333" />
<embed src="test.swf" allowNetworking="none" bgcolor="#333333"
width="600" height="400"
name="test" align="middle" type="application/x-shockwave-flash"
pluginspage="http://www.macromedia.com/go/getflashplayer" />
</object>
An HTML page may also use a script to generate SWF-embedding tags. You need to alter the
script so that it inserts the proper
Flash and Flex Builder use the
files, and you need to add the
following:
AC_FL_RunContent( ... "allowNetworking", "none", ...)
The following APIs are prevented when
navigateToURL()
■
fscommand()
■
■ ExternalInterface.call()
464 Flash Player Security
and tags in the HTML page that contains the SWF
<embed>
are:
parameter, in the
<object>
allowNetworking
AC_FL_RunContent()
allowNetworking
allowNetworking
and <embed> tags in the HTML
allowNetworking
settings. HTML pages generated by
function to embed references to SWF
parameter settings to the script, as in the
is set to
"internal"
allowNetworking
parameter and set its
: