Flash / Flex security

Hello,
probably this sounds really silly... however wanted to ask
just how secure is Flex/Flash? Since it's on the client, a user can
easily decompile a .swf and modify any variables and pass them to
the server.. you know like client script to server.
also is there something that can be done to invalidate the
application or the .swf once a third party client modifies any
variables?
I wanted a 100% confirm.
Thanks!

It wouldn't be possible to hijack the SWF bytecode and alter
it on the fly - it is too complex for that (and if someone can do
that with an AI of some sort, well, no one is safe). They will have
to copy the SWF and mess with it, then post it to some domain of
their own and then the Flash Player will recognize the different
domains.
Another thing you can do is have a shell SWF which loads your
main swf. This is atypical behavior and while it does make a second
request to the server (which someone can see with a sniffer) you
can use this to your advantage.
When you load main.swf into shell.swf, you can ask main.swf
how many bytesTotal it is. Then you change shell.swf to hold this
value: var mainSize:int = 654321. Now shell.swf requests main.swf
and compares main.swf's size against mainSize. If shell.swf sees
that the values aren't identical, it knows main.swf isn't correct.
This isn't 100% foolproof, but someone would have to a) know
you are doing this and b) hack your main.swf in such a way that the
byte size remains the same. Quite a challenge I think.
Finally, all security measures are automatic. You can
override some of them (check the documentation for the
Security.allowDomain function and others in the Security class).
One more thing: suppose someone writes their own shell.swf
and uses it to load your main.swf. Unless they have access to your
server, they will launch their evilshell.swf from their domain:
evildoer.com. That becomes the "home" domain for the Flash Player.
Now they load your swf from yourdomain.com. Since evildoer.com is
not yourdomain.com, your SWF can request your data, but since the
home domain is no longer yourdomain.com, there is a security
violation. The home domain for the Flash Player must be
yourdomain.com in order to read data from yourdomain.com.
Anyone loading your swf into their swf also cannot access
data and functions (see allowDomain) so your information is still
protected.

Similar Messages

Flash / Flex - security in corprate environment

we are considering platforms to develop a new project with, flex came up and is very appealing.however, we are dealing with a hosted solution which will be used by companies who'se users will need to download the swf to their browser. Are there any problems that may occur in a company that has strcit security policies that may cause the swf download to fail?
thanks in advance

Hmmm... May need to use AIR, or else upload those local
assets to server then download. Strange but maybe this is
so.

Calling C++ code from Flash/Flex

Hi everybody!
Does anyone know how to call a DLL (C++) -function in Flex or
Flash with Actionscript, or any other (easy?) way to access C++
code?
I love developing in Flex, but actionscript is an easy
language with some restrictions, so that's why i'd really like to
have C++ code in Flex/Flash. :)

Calling out to a dll of C++ would break the Flash Player
security model. So it is prohibited. Check out Adobe Labs and look
at the AIR runtime. Air allows
Flex applicationS to run as desktop applications not web
application with the web type security restrictions.
Also some folks are developing and open source way to
integrate Java with air.
http://artemis.effectiveui.com/

How to use a Flash/Flex GUI for DW Extensions

I am creating a DW extension for an image and flash gallery.
The extension will be accessible from the Insert menu. Once
clicked, it would present me with a Flash/Flex form to
search/browse for images/swf by file name or tags. Once I select an
image/swf and clicked OK, it would insert into my webpage the
absolute URL associated with the image/swf. The problem is I am not
aware of how to create an extension with a Flash/Flex GUI.
Any suggestions would be greatly appreciated.
Thanks,
srtr4k

You should check out the Flash panels and Dialogs section of
the Dreamweaver API reference. Here is a link.
http://help.adobe.com/en_US/Dreamweaver/10.0_API_Ref/WS4FB61645-9C4E-4667-B6D4-0E5F553BEF4 F.html
This gives you direct access to Flash panels and dialogs from
the Dreamweaver Javascript API. Adobe is working on a document for
how to create CSXS based Flash Extensions. CSXS based extensions
only work as a floating panel that surface themselves in the
Windows, Extensions menu.
-Scott Richards
Dreamweaver Team

Flash Player security Pop up when using camera and microphone.

Hello Friends
Can any body suggest me how to remove flash player security pop up for camera and microphone through coding.
Thanks in advance.

The security pop-up was first introduced with FP7. If you want to bypass it I can name two ways off the top of my head:
1. Regardless of ActionScript version (2.0/3.0) in the Flash authoring enviroment, in the Publish Settings dialogue box, the Flash tab, near the bottom choose Access Network Only from Local Playback Security.
2. Publish your movie as a projector. Both of these techniques will allow to "play" your swf file locally.

Compiling an existing as3 packag with flex sdk (for a flash/flex/as beginner)

Hi
I am new to flash, flex, mxml, and actionscript (with a strong background in c, python, and scheme and some background in Java, VBA, and Javascript). I have a website for which I would like to develop some simple swf content. Basically, I would like to load esri shp files at runtime (and display a series of them as an animation) using these APIs.
I have read through some flex getting started material, but I have found that there is no better way to learn a framework/language than to look at and modify existing code. Happily, I've found a sample that is both salient to my project and about the right level of complexity.
I have the Flex SDK 3 and have created some simple movies. However, I haven't managed to compile the example as3 source code to a successful swf movie. I'd like to write mxml for layout/structure and as3 for functionality, and compile with mxmlc, period. Most examples I've found use of Flex Builder, Adobe Air plugins, other IDEs, etc and so they aren't very helpful.
Here is a link to the content I'm interested in, and more importantly the as3 source packages (zip or browesable) that I'd like to compile. There are two: ManualCartogramTest.as and USStatesCartogramExample. I can use mxmlc to compile either one sucessfully, but the resulting swf file displays nothing. It seems that I should use the ManualCartogramTest class to create an instance of it, but none of my efforts have worked.
Can anyone help out? How should I generate the swf movie given one of these packages? What key piece am I missing?
Jeff
For completeness, here is another example using the shp/dbf packages (from the creator) that I just can't figure out what to do with.

1. Perhaps this wasn't the right forum.
2. I had to use set -use-network=false to enter "local-with-filesystem" mode. Unfortunately, it took a while before I finally used a flash player that told me the problem instead of silently failing. The linux standalone or linux debugger from adobe was key! Gnash, swfdec, and my firefox plugin hid the problem.

Help flash player security popup

Hello i keeps on having this message poping up on my Fire Fox browser. Its to do with Flash Player Security. anyone able to help???
Adobe Flash player has stopped a potentally unsafe opperation. The following loacal application on your computer or network chrome\\tavgp\content\html\tabswelcom.htm is trying to comunicate with this internet-enabled location: s.nsdsvc (that part changes) To let this application communicate with the internet, click settings.

jamesp282 wrote:
To let this application communicate with the internet, click settings.
And did you click Settings?
You may also be able to change the security settings at http://www.macromedia.com/support/documentation/en/flashplayer/help/settings_manager04.htm l

Faces expression in Javascript? Flash/Flex and Faces Session Variables

Does anyone know how to add a faces expression in Javascript?
I basically want to pass a Faces Variable to Flash/Flex. The best way to do that would be in Javascript.
I thought it would be fairly easy. Something like:
                    <webuijsf:script binding="#{Page1.script1}" id="script1" >
                        function foo() {
                          var text = #{Page1.textField1.text};
                          alert(text);
                    </webuijsf:script>Or something like that, and hope that the Faces expression will be expanded before sent to the browser. Unfortunately, that's not happening:
SEVERE: Servlet.service() for servlet Faces Servlet threw exception
org.apache.jasper.JasperException: /Page1.jsp(16,38) #{..} is not allowed in template textWhen ran in the HTTP context of NetBeans.
Edited by: Neelixx on Apr 5, 2008 4:42 PM - Clarified using more javascript example

Have a look at Shared Objects, I think these are the sort of
thing you are after. I think the "Specifying a path" subtopic
should be particularly relevant for sharing the variables/objects
between the two swf files.
Livedocs
- Shared Objects

Adobe Flash Player Security on Mac OSX 10.8.5

Hello, I need some help. I keep getting an Adobe Flash Player Security warning every time I try to load Pandora on my Mac. I not sure if this is some form of spyware. I've tried to research it online but I can't find anything with this specific error message. Also I've run a few antivirus/spyware programs, but turned up with nothing. I've never come across it before when using Pandora in the past, so I know it's something out of the ordinary.
Thank you all very much for the assistance.

There's a local file "/about/srcdoc" (I'd imagine it's in the Muse-Pandora folder) that's attempting to connect to the Internet. This is a "safety feature" built into Flash Player to prevent malicious files from connecting and downloading a virus. Why they have that for Mac OS I do-not-even-pretend-to-know, but it's there.
Open your System Preferences and the Flash Player pref pane
Click the "Advanced" tab in the Flash Player Settings Manager window
Scroll down to Developer Toos and click "Trusted Location Settings...:
Click "Add Folder..."
Select the Muse-Pandora folder in your Applications folder
Confirm
Close the Manager and retry it.

Losing portal context when URL is submitted from flash/flex portlet

Hi, I am losing portal context when URL is submitted from action scripting in Flash/Flex portlet. I have selected the remote webservice portlet to use inline refresh. The jsp page is opening up in complete browser window instead of showing in portlet section.
below is the code snippet i am using.
<mm:mxml>
     <mx:Application xmlns:mx="http://www.adobe.com/2006/mxml" width="400" height="200">
     <mx:Script><![CDATA[
     public function submitToBrowser():void {
     var url:String = "formsubmit.jsp";
     var u:URLRequest = new URLRequest();
     var variables:URLVariables = new URLVariables();
     variables.name = fName.text;
     u.data = variables;
     u.url = url;
     u.method = "POST";
     navigateToURL(u,"_self");
     ]]></mx:Script>
          <mx:Form id="myForm" defaultButton="{mySubmitButton}">
          <mx:FormItem label="User Name">
          <mx:TextInput id="fName" name="fName"/>
          </mx:FormItem>
          <mx:FormItem label="Password">
          <mx:TextInput id="password" displayAsPassword="true"/>
          </mx:FormItem>
          <mx:FormItem>
          <mx:Button label="Submit" id="mySubmitButton"
          click="submitToBrowser();"/>
          </mx:FormItem>
          </mx:Form>
     </mx:Application>
</mm:mxml>

inline refresh modifies javascript, not flex. Maybe try an iframe?

Mac Safari "Adobe Flash Player Security" issue

Using Captivate 5.5 for Mac. I've been having sporadic problems viewing my published .htm files in Safari. I always get the "Adobe Flash Player Security" popup on initial load, but before today I could usually just click OK and refresh the browser window to play the Flash content. Today I can no longer view the content in Safari. (Firefox plays the content fine.)
The popup says "To let this application comminicate with the Internet, click "Settings". When I click Settings, my Mac OS Flash preference dialog opens. But the only options available are "Local Storage Settings", "Camera and Mic", "Playback" (which pertains to peer-assisted networking, not local playback), and "Advanced" (which only allows you to delete local files). Just for experimentation, I tried adding my local path as an allowed site in "Local Storage Settings" but it doesn't have any effect.
I don't have any other problems using regular Flash-based websites in Safari. Only my published Captivate files spawn this security popup.
How do I fix this?

It worked! Thank you. (Actually, I used the related URL for "Global security settings for content creators" (http://www.macromedia.com/support/documentation/en/flashplayer/help/settings_manager04a.ht ml#119065) since that URL is intended for local development/testing, whereas the link you provided is for sites on the Web.)
But I'm curious. . . according to Adobe (http://www.macromedia.com/support/documentation/en/flashplayer/help/settings_manager.html), "Beginning with Flash Player 10.3, the Local Settings Manager supersedes this Online Settings Manager for managing global settings on Windows, Mac, and Linux computers." Yet the page goes on to explain when one would use the online Global Settings. This is very confusing. If the local Settings Manager supercedes the online manager, why would the online manager still be required for certain uses? And why isn't a link to the Global Settings manager provided within the local Settings manager. What am I not understanding?

Adobe flash player security blocking

The adobe flash player security is blocking mail with the message /about/srcdoc is trying to communicate with this interner-enabled location static.adsafeprotected.com
How do I get rid of this?

IanGCou wrote:
How much of a risk is it unblocking?
If you select a single site to allow, not much, as long as it's a trusted site and you're careful about what you open there (in this case it being mail, you need to use your own discretion). If you set Flash Player to allow ALL sites, then you may be opening yourself up to anything from spyware to outright viruses.

Adobe Flash Player Security pop up during installation.

Hello, I recently purchased a macbook this week. My first apple computer. I was downloading and installing a widget, astroids, through apples website and after installation I noticed a dialogue box appeared. It said "Adobe Flash Player Security" as the title and then it showed where the downloaded file was located. I looked in the folder where it said it should be located but nothing was in that folder. I couldn't close the message box, it just stayed their with my mouse pointer doing a circular pattern. I eventually restarted my computer because I didn't know how to get rid of it. My question is should this be something I should be be worried about? Is everything ok with my macbook? Sorry if this sounds silly, I am new to owning an apple computer and trying to get familiar with it. Thank You.

For the Flash Player stuff, start with http://www.adobe.com/products/flashplayer/articles/localcontent/
After sorting that out, see:
Switching from Windows to Mac OS X,
Basic Tutorials on using a Mac,
Mac 101: Mac Essentials,
Anatomy of a Mac,
MacTips, and
Switching to the Mac: The Missing Manual, Snow Leopard Edition.
Additionally, *Texas Mac Man* recommends:
Quick Assist.
Welcome to the Switch To A Mac Guides,
Take Control E-books, and
A guide for switching to a Mac.

Why does Flash/Flex Builder 4 Premium downgrade to Standard when I install Flash Player Debug?

Why does Flash/Flex Builder 4 Premium downgrade to Standard when I install Flash Player Debug?
I installed a corporate install of Flex/Flash Builder 4 Premium, and verified that it was the Premium version was installed. The Start Page said that Flash Player was needed to display the text, so I installed Flash Player 10 Debug -- first download link from here:
http://www.adobe.com/support/flashplayer/downloads.html
When I then started Flex Builder 4, the splash screen showed Premium, but as soon as the Start Page was visible, it showed "FB Adobe Flash Builder 4 Standard" --- Help | About showed Standard, and the splash screen from then on showed Standard.
A Google search showed a work around for this, but it requires a license for Premium, which I don't have because our corporate install has it built-in:
http://bloginblack.de/2010/05/adobe-master-collection-cs5-breaks-flash-builder-4-premium-a nd-how-to-fix-it/
1. Anyone know how to resolve this?
2. Can Adobe fix this?
Thanks!

I had similar problem. I was involved in Flash Builder prerelease program and few months later I installed Adobe CS5 Master Collection. After that I had a same situation. Best thing was, my Flash Builder Beta was Premium version but acted like Standard, and FB from CS5 was Standard but acted like Premium. I removed CS5 and beta version of CS5. used CS5 Cleaning Fix and then reinstalled my apps.
I was lucky that I didn't have many big projects involved in FB beta or CS5 workspaces, I heard some guys had problems with migrated workspace configurations but I don't know what was the problem.

Flash Player Security error when publishing HTML files

I am new to the Captivate world and am just in love with the
features - but I have been having a very difficult time publishing
my "movies". I have 8 files that are all called upon in one movie
(like a table of contents). I have abandon the though of publishing
each as an EXE file - and have decided to go the HTML route.
However when I try to run the published HTML file I get an Adobe
Flash Player Security error - saying "Adobe Flash Player has
stopped a potentially unsafe operation." It then says that the
local SWF file is trying to communicate with the Internet-enabled
HTM file.
Can someone please tell me what this means? We are using
Captivate for distance learning as well as internal - so I can't
know for sure what the end-users will be using when the files are
used.
Any assistance would be greatly appreciated.

Welcome to our community, Rachel
Where are you running your movie from? If you are planning on
running them from a server, there should be no need to worry about
your end user seeing those messages. However, if you are planning
on each user copying them to their own hard drive or if you are
running from a CD-ROM, you may need to perform some trickery to
make them work without issue.
The message is occurring because there are links in some of
the files that point to internet resources and the Flash player is
seeing that as a potential security risk. So it is blocking the
action until you pat it on the head and assure it the world will
not, in fact, end if it shows you the content.
If you wish to banish the screen on your PC, take a look at
the tutorial linked below.
Click
here to view a tutorial
I'll hold off on the other bit until I'm certain what we are
dealing with.
Cheers... Rick

Flash / Flex security

Similar Messages

Maybe you are looking for