Türkçe
English

FlashPlayer Security and bypassing swf access restrictions

lock icon

FlashPlayer has an isolated sandbox model to provide personal information and data security and to prevent theft.

When you compile (or export) a swf, you must choose a sandbox model which are local only and network only. For example a swf compiled for local sandbox can not retrieve data from internet, can not load any type of file such as xml, jpeg, png, swf and can not send data via GET and POST. Also, a swf which is compiled for network sandbox can not access any local resources (except SharedObjects which is a minimal, isolated data storage system like HTTP cookies).

To bypass this restriction, i mean to make a swf to access any local or remote resource, you can change FlashPlayer settings via FlashPlayer gui but this is a bit complicated and an end user might not set it correctly and might be a bit painful.

Furthermore, if you're a developer, and if you want to do it without confusing end user, this doesn't work.

Solution: To create a small configuration file for the swf's which you make FlashPlayer accept them as secure and place this configuration file in a specific place of operating system.

To do this:

  • Fire up a text editor
  • Enter full paths of swf(s), file(s) or apps that contain swf(s) (such as html, exe, app, bin), folder(s) that contain swf(s)  which you want to declare as secure. Type them as separate lines.
  • Every single line must keep a separate path entry (your Flash/Flex app might contain multiple swf's).
  • You can enter multiple paths into one file or you can enter single item for each separate file.
  • Finally, save your file as anyFileName.cfg (no matter what you name it. important point is file extension (.cfg)).

Permission process can be done in computer or user contexts.
If you permit for computer, all users can execute the swf as unrestricted
If you permit for user, only that user can execute the swf as unrestricted, other users execute the swf as restricted.

To permit for computer context:

copy your .cfg file(s) to

on Windows:
C:\WINDOWS\system32\Macromed\Flash\FlashPlayerTrust

on Mac OS X:
/Library/Application Support/Macromedia/FlashPlayerTrust

If you can't see FlashPlayerTrust folder, just create one with this exact name.

To permit for user context:

copy your .cfg file(s) to

on Windows:

C:\Documents and Settings\<YOUR_USERNAME>\Application Data\Macromedia\Flash Player\#Security\FlashPlayerTrust

on Mac OS X:
/Users/<YOUR_USERNAME>/Library/Preferences/Macromedia/Flash Player/#Security/FlashPlayerTrust

If you can't see FlashPlayerTrust folder, just create one with this exact name.

Sample .cfg file content:

  1. # This is a comment line, the foler below and it's subfolders are permitted
  2. C:\MyFlashApps
  3. # The App.exe below may be an application which contains a swf
  4. C:\Program Files\MyApplication\App.exe
  5. D:\Users
  6. D:\MyApplication\myAppName.swf
  7. D:\MyApplication\myAppName.html
  8. # To ensure permission when you're not sure about drive letter
  9. A:\main.swf
  10. C:\main.swf
  11. D:\main.swf
  12. E:\main.swf
  13. F:\main.swf
  14. G:\main.swf
  15. H:\main.swf

Brief, if you copy the .cfg file above to
C:\WINDOWS\system32\Macromed\Flash\FlashPlayerTrust
the swf is assumed secure and all restrictions are removed for all users.


If you copy it to

C:\Documents and Settings\<YOUR_USERNAME>\Application Data\Macromedia\Flash Player\#Security\FlashPlayerTrust
the swf is assumed secure and all restrictions are removed for only current user.

I wasn't aware there is such

I wasn't aware there is such a security risk, but now that I know, I'll make sure to follow these steps. I didn't notice anything strange regarding my system so far though, so hopefully the content security software I use kept me safe...

Post new comment

You don't have to register to post comments but if you don't, you can't modify your comment later. You better register.
The content of this field is kept private and will not be shown publicly.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Allowed HTML tags: <a> <em> <strong> <cite> <code> <ul> <ol> <li> <dl> <dt> <dd>
  • Lines and paragraphs break automatically.

More information about formatting options

CAPTCHA
This question is for testing whether you are a human visitor and to prevent automated spam submissions.
Image CAPTCHA
Enter the characters shown in the image.