Seems to be a question for a Flash security guru.

Suppose we are loading an external SWF movie with
MovieClipLoader.loadMovie(url:String) Is it safe to assume that if url
starts with "http://";, the movie will be loaded in REMOTE sandbox?

We need to tell local SWFs from remote ones to close a security hole.

If you need the context read on.

We have developed a Projector, written in C++ embedding Flash Player
ActiveX. Our Flash application runs inside the Projector. Soon we want to
give our users a way to create plugins for the application. The plugins are
obviously will be SWF movies.

The case I'm afraid of is the following. A bad person creates a malicious
evil.swf pretending it to be nice plugin for our app. In case evil.swf is
loaded from the local file system it is granted an access to the whole
MovieClip tree and Projector API, opening C++ file access operations.

On the other hand if evil.swf is loaded from the internet, remotely, it will
be locked in REMOTE sandbox by Flash security model.

Because of this, we need a reliable way to tell local SWF from remote one
before loading it. And we must not make a mistake.

So again, is it safe to assume that if url begins with "http://";, the clip
will be loaded inside REMOTE sandbox?

Flashcoders mailing list

Reply via email to