
FlashPlayer has an isolated sandbox model to provide personal information and data security and to prevent theft.
When you compile (or export) a swf, you must choose a sandbox model which are local only and network only. For example a swf compiled for local sandbox can not retrieve data from internet, can not load any type of file such as xml, jpeg, png, swf and can not send data via GET and POST. Also, a swf which is compiled for network sandbox can not access any local resources (except SharedObjects which is a minimal, isolated data storage system like HTTP cookies).
To bypass this restriction, i mean to make a swf to access any local or remote resource, you can change FlashPlayer settings via FlashPlayer gui but this is a bit complicated and an end user might not set it correctly and might be a bit painful.
Furthermore, if you're a developer, and if you want to do it without confusing end user, this doesn't work.
Solution: To create a small configuration file for the swf's which you make FlashPlayer accept them as secure and place this configuration file in a specific place of operating system.
To do this:
Permission process can be done in computer or user contexts.
If you permit for computer, all users can execute the swf as unrestricted
If you permit for user, only that user can execute the swf as unrestricted, other users execute the swf as restricted.
To permit for computer context:
copy your .cfg file(s) to
on Windows:
C:\WINDOWS\system32\Macromed\Flash\FlashPlayerTrust
on Mac OS X:
/Library/Application Support/Macromedia/FlashPlayerTrust
If you can't see FlashPlayerTrust folder, just create one with this exact name.
To permit for user context:
copy your .cfg file(s) to
on Windows:
C:\Documents and Settings\<YOUR_USERNAME>\Application Data\Macromedia\Flash Player\#Security\FlashPlayerTrust
on Mac OS X:
/Users/<YOUR_USERNAME>/Library/Preferences/Macromedia/Flash Player/#Security/FlashPlayerTrust
If you can't see FlashPlayerTrust folder, just create one with this exact name.
Sample .cfg file content:
# This is a comment line, the foler below and it's subfolders are permitted C:\MyFlashApps # The App.exe below may be an application which contains a swf C:\Program Files\MyApplication\App.exe D:\Users D:\MyApplication\myAppName.swf D:\MyApplication\myAppName.html # To ensure permission when you're not sure about drive letter A:\main.swf C:\main.swf D:\main.swf E:\main.swf F:\main.swf G:\main.swf H:\main.swf
Brief, if you copy the .cfg file above to
C:\WINDOWS\system32\Macromed\Flash\FlashPlayerTrust
the swf is assumed secure and all restrictions are removed for all users.
C:\Documents and Settings\<YOUR_USERNAME>\Application Data\Macromedia\Flash Player\#Security\FlashPlayerTrust
the swf is assumed secure and all restrictions are removed for only current user.
I wasn't aware there is such
I wasn't aware there is such a security risk, but now that I know, I'll make sure to follow these steps. I didn't notice anything strange regarding my system so far though, so hopefully the content security software I use kept me safe...
Post new comment