The purpose of those files and IFRame is to allow the Flex app to be navigated using the browser Forward and Back buttons.
I never use this functionality myself. You can turn it off in the Project, Properties, Compile dialog. That will remove the js file and will not pit the IFrame in the wrapper. Tracy Spratt, Lariat Services, development services available _____ From: [email protected] [mailto:[email protected]] On Behalf Of Parkash Sent: Monday, March 30, 2009 2:43 AM To: [email protected] Subject: [flexcoders] Fortify Scan on my Application. Hello All, I ran fortify scan on my application and getting the three hot issues on history.js and historyFrame.html. How can I eliminate the problems from these files? Do I really need these files can I delete these files can any one tell me the purpose of these files. The hot issues are listed below. Issue # 1: ABSTRACT: The method addHistoryEntry() in history.js sends unvalidated data to a web browser on line 207, which can result in the browser executing malicious code. EXPLANATION: Cross-site scripting (XSS) vulnerabilities occur when: 1. Data enters a web application through an untrusted source, most frequently a web request or database. 2. The data is included in dynamic content that is sent to a web user without being validated for malicious code. The malicious content sent to the web browser often takes the form of a segment of JavaScript, but may also include HTML, Flash or any other type of code that the browser may execute. The variety of attacks based on XSS is almost limitless, but they commonly include transmitting private data like cookies or other session information to the attacker, redirecting the victim to web content controlled by the attacker, or performing other malicious operations on the user's machine under the guise of the vulnerable site. Issue # 2: ABSTRACT: The method checkForUrlChange() in history.js sends unvalidated data to a web browser on line 283, which can result in the browser executing malicious code. EXPLANATION: Cross-site scripting (XSS) vulnerabilities occur when: 1. Data enters a web application through an untrusted source, most frequently a web request or database. 2. The data is included in dynamic content that is sent to a web user without being validated for malicious code. The malicious content sent to the web browser often takes the form of a segment of JavaScript, but may also include HTML, Flash or any other type of code that the browser may execute. The variety of attacks based on XSS is almost limitless, but they commonly include transmitting private data like cookies or other session information to the attacker, redirecting the victim to web content controlled by the attacker, or performing other malicious operations on the user's machine under the guise of the vulnerable site. Issue # 3: ABSTRACT: The method lambda() in history.js sends unvalidated data to a web browser on line 509, which can result in the browser executing malicious code. EXPLANATION: Cross-site scripting (XSS) vulnerabilities occur when: 1. Data enters a web application through an untrusted source, most frequently a web request or database. 2. The data is included in dynamic content that is sent to a web user without being validated for malicious code. The malicious content sent to the web browser often takes the form of a segment of JavaScript, but may also include HTML, Flash or any other type of code that the browser may execute. The variety of attacks based on XSS is almost limitless, but they commonly include transmitting private data like cookies or other session information to the attacker, redirecting the victim to web content controlled by the attacker, or performing other malicious operations on the user's machine under the guise of the vulnerable site. Issue # 4: ABSTRACT: The method ~file_function() in historyFrame.html sends unvalidated data to a web browser on line 25, which can result in the browser executing malicious code. EXPLANATION: Cross-site scripting (XSS) vulnerabilities occur when: 1. Data enters a web application through an untrusted source, most frequently a web request or database. 2. The data is included in dynamic content that is sent to a web user without being validated for malicious code. In this case the data is sent at write() in historyFrame.html at line 25. The malicious content sent to the web browser often takes the form of a segment of JavaScript, but may also include HTML, Flash or any other type of code that the browser may execute. The variety of attacks based on XSS is almost limitless, but they commonly include transmitting private data like cookies or other session information to the attacker, redirecting the victim to web content controlled by the attacker, or performing other malicious operations on the user's machine under the guise of the vulnerable site. Thanks Parkash
