Security behaviour in Adobe Air - apache-flex

I am trying to load external SWFs in my Adobe AIR App. The loaded SWF is trying to access an URL to retrieve some informations via XML.
When starting the SWF by itself it works fine. When loading the SWF from the File.applicationStorageDirectory i will get an Security-Error because the loaded App is executed in a local-with-filesystem Sandbox appareantly.
First Question: Is there a way to change this? That the loaded SWF is running in a network Sandbox?
Since that first attempt didn't worked i've moved the SWF to the app:// directory.
Now i'll get a Security-Error because there is no policy file on the Server available where the XML data should be retrieved.
Second Question: Why is the policy file not necessary when running the SWF by itself, but is necessary when trying to load the data from the application Sandbox? What am i doing wrong?
Thanks in advance!

Here is my solution.
I am doing an ActionScript-based app btw. My goal here is the create an AIR Application that loads different modules on demand from a given internet ressource. The two applications are using the child/parentSandboxBridge to communicate.
I was using the SWFLoader class but did not correctly pass the LoaderContext with allowLoadBytesCodeExecution (or allowCodeImport for AIR2.0). As i was passing a LoaderContext with the mentioned variable, i was getting an VerifyError: Error #1053: Illegal override of activate in mx.managers.SystemManagerProxy since the AIR Application is done with Flex 4.0 and the loaded SWF is compiled with Flex 3.5.
The reason that error was thrown although the loadForCompatibility property was set to true was, that the SWFLoader class does not set the necessary applicationDomain for compatibility when a LoaderContext Object is passed. So i did the applicationDomain setting myself and everything works like a charm.
If anyone is interested in this procedure, just look into the SWFLoader::loadContent Method. In Flex 4 the interesting part starts at line 1836.

Related

Flash inside Flex inside ExtendScript

i have been working on a Photoshop UI project and also working with Flash Builder for about 3 weeks and i can't find a solution to a communication problem. Here are some details about the issue; if you are interested in helping me, thanks.
The main frame of the UI is Extendscript
I have an as3 swf which needs to load a local JPG file dynamicly, I
assume this is a "Access Local Files Only" situation for Flash.
The same SWF needs to communicate with Extendscript, so i load it into
a FLEX app dynamicly via SWFLoader and it passes some variables to,
and triggers some functions in FLEX via a "myFlexParent" object.
Flex is the bridge between Flash and Extendscript so it passes the
variables and functions to Extendscript JSX code via
Externalinterface.call or CSXSInterface.instance.evalScript().
This is where i'm STUCK. I guess ExternalInterface calls or CSXSInterface.instance.evalScript() are threated as a network operation and they don't work if i set the compile option "-use-network=false" in flex. Bu otherwise the local JPG file cannot be loaded.
Adding locations in the Settings Manager wont work for me because i'm going to turn the UI into an Extension and it should be easy to install.
I guess i'm trying to find a way to establish 2 way communication between FLEX and ExtendScript, that would be interpreted by flash player as a LOCAL communication, which actually is.
I'll appreciate any bit of information. Thanks.
ExternalInterface is going to be considered a network call and setting the -use-network=false will break those calls down. This is due to the security sandbox. If it was allowed then the flash app could be used with some simple AJAX to turn a non-network app into a network app very easily.
Adobe doc's say:
This communication relies on the domain-based security restrictions
that the allowScriptAccess and allowNetworking properties define. You
set the values of the allowScriptAccess and allowNetworking properties
in the SWF file’s wrapper.
Reference link:
http://help.adobe.com/en_US/flex/using/WS2db454920e96a9e51e63e3d11c0bf6167e-7fff.html#WS2db454920e96a9e51e63e3d11c0bf6167e-7ff5
Look into changing your app into an AIR app as you will be able to do both network and local file operations (different security model since the user installs the application).

loadMovieNum in AS2/1 files loaded into an Air-based AS3 / Flex application

I am working with a very large number of legacy SWFs written in AS1 and AS2. These SWFs use loadMovieNum extensively.
I am trying to integrate these into a new Air-based app (written in either AS3 or Flex). However, loadMovieNum doesn't seem to work within the Air app.
For example, an AS2 SWF (file1.swf) may try to load another AS2 SWF using:
loadMovieNum("http://127.0.0.1/file2.swf", 5);
This works fine if the SWF is played indepedently but if it is played from within the Air app, it fails.
EDIT: What happens in the Air app is that file1.swf will load successfully but silently fails to load file2.swf. There are no errors and no exceptions. A try...catch around the loadMovieNum reports nothing and file1.swf continues to play.
The relevent code from the Air app is as follows:
AS3 version:
var mLoader:Loader = new Loader();
var mRequest:URLRequest = new URLRequest("http://127.0.0.1/file1.swf");
mLoader.contentLoaderInfo.addEventListener(Event.COMPLETE, onCompleteHandler);
mLoader.load(mRequest, loaderContext);
function onCompleteHandler(loadEvent:Event):void
{
// Add to the stage
addChild(mLoader.content.parent);
}
Flex version:
<mx:SWFLoader id="swfObj" source="http://127.0.0.1/file1.swf" />
It is simply the case that loadMovieNum will not work in Air? Or is there something that can be done. Obviously, making extensive changes to the legacy SWFs is, in all liklihood, not possible.
Thanks in advance.
I've concluded that _levels are not supported in SWFs that are loaded directly into Air apps. For example, even _level0 (which should always be defined) returns as undefined. Consequently, it would appear very unlikely that loadMovieNum would be supported.
I have discovered a workaround, though. Using the HTML browser component in Air, a webpage - in which the AS2/1 SWFs are embedded - can be loaded into the Air app. If you do this then loadMovieNum works as expected in the AS2/1 files.
AS3 version:
var hLoader:HTMLLoader = new HTMLLoader();
addChild(hLoader);
hLoader.width = stage.stageWidth;
hLoader.height = stage.stageHeight;
hLoader.load(new URLRequest("file1.html"));
Flex version:
<mx:HTML id="minibrowser" width="100%" height="100%" location="file1.html" />
Unfortunately, the HTML component is not supported by all Air profiles. In particular, in my case, it is not supported by the TV profile.
Although it may not seem intuitive, this seems like a security issue. When AS2 content loads up other AS2 content, they have to be in the same security sandbox in order for them to run.
I created a quick sample just to test this theory and I was right. The reason it works in Flash is because the AS2 content is in the same sandbox as the content it is loading. But AIR security is different. So when you load up the AS2 content in AIR (using the logic you supplied), the loader gets put in the application sandbox. The sandbox is now different than the content it is loading, so it refuses to load them.
This explains why it works when using an HTML wrapper. When the HTML loads up the swf, it probably gets put in the local-with-network sandbox which is the same as the content.
So... How do you fix it?
You can try to load your content up in a different security sandbox. But really the problem is that AS3 security isn't playing nice with the AS2 security. My suggestion would be to create the AIR application without an AS3 wrapper. You can't do this directly in the tooling, but you should be able to use the ADT packager to do it. In the xml descriptor, make the initial content the AS2 swf, and package it together. Now when you launch your AIR application it uses the AS2 swf as the main application. Suddenly your files should all be in the same security sandbox, and Flash won't prevent any of the content from running.
You can test this locally by using ADL to launch the app instead of launching it directly from Flash Professional or Flash Builder. (They both use ADL, but if you call it directly you have more control over the arguments used.)
EDIT: Apparently you can't have an AS2 swf as the main swf for Desktop AIR applications. (I've tested using ADL on desktop and it works, but I have been told that you won't be able to install an AIR application on desktop with this setup.) So for desktop you probably want to use the HTML workaround. This is supported in AIR for TV, so this would work on those devices.

Running 'abc.swf' v/s 'abc.html'

(1)When I run the HTTPService code in Flex builder and use Ctrl F11 to run the application then the HttepService runs fine and returns the value. Here, it is run inside an html wrapper 'mypath\Learning\bin-debug\httpServiceissue.html'
(2)The same code when I compile through command-line and then run in Flash PLayer then it won't run. This time its running on its own without html wrapper around.
Also, setting '-use-network = false' in command line (2 approach) allows flash player to load this file. I know that setting flag false will restrict SWF's access to local machine (no network) and give it access to local resource, but then why it works in Flex builder inside the html wrapper (in 1 case).
Please share you opinion on this.
'mx:HTTPService id="rooms" url="myfile.txt" fault="httpFaultHandler(event)" resultFormat="e4x" result="httpResultHandler(event)"'
I'm not really sure, I've never tried to use the service in that way. It might be a security, or "sandbox" restriction, that unless you've got a "crossdomain.xml" you can't get to any resource that isn't in the same domain. Would the txt file be delivered by some kind of web server when you hit F11?
Good luck, please let us know when you find an answer.

as3 access an object inside a loaded swf

I have two swf, one loads the other using a Loader class, in the loaded swf I have a NetConnection object which I need to access from the host swf, but I can't, if I debug the app, I see the obejct is there, but I can't access it, if I try to set a variable like
loadedSWF = connectorLoader.content (connectorLoader is the Loader object)
loadedSWF is always null
If I debig the app, I see the NetConnection in the loaded SWF, but I can't have access to it, I have try to use Security.allowDomain("*") in both swf to be sure, but nothing, I thought that only doing the allowDomain method I will have access to the loaded SWF objects
I'm usign Flas Player version 10.1
thanks! for any help
That said I would make sure that your loaded swf is a debug swf? Do you have the source code for the debug swf? In Flash Builder when specifying external libraries, you have to specify the source code location. How do you expect the Flex Debugger to be aware of the source code location for an asset loaded at runtime?
I don't think it was possible to debug through loaded assets.

404 Error using Flash Builder 4 BlazeDS wizard

My issue this time around is trying to use the new DCD BlazeDS wizard in Flash Builder 4. If I set my project up as a combined Java/Flex app I am unable to connect to the RDS servlet using the wizard. I get a 404 error every time.
I'm certain the service is set up correctly since my app can access the exposed java classes and BlazeMonster can see the exposed services.
Is anyone else having this issue and if so has anyone found a work-around? I'd very much like to use the code generation features of the wizard for my project.
Thanks as always,
Codeflayer
You also need to make sure you have the RDSDispatchServlet setup in the web.xml config file.

Resources