Reviewing Flash Applications - Revision history

Thomas Herlea: Added navigation to facilitate sequential reading online

2010-09-09T16:52:01Z

Added navigation to facilitate sequential reading online

Thomas Herlea: moved Flash Applications to Reviewing Flash Applications: The new title better reflects the content and follows the convention used by many other section titles in the Code Review Guide

2010-09-08T12:37:14Z

moved Flash Applications to Reviewing Flash Applications: The new title better reflects the content and follows the convention used by many other section titles in the Code Review Guide

Puhley: /* Permission Structure */

2010-04-18T19:19:51Z

‎Permission Structure

Puhley: /* Accessing JavaScript */

2010-04-18T19:12:02Z

‎Accessing JavaScript

KirstenS: /* Permission Structure */

2009-02-11T10:43:22Z

‎Permission Structure

KirstenS: /* SandBox Security Model */

2009-02-11T02:09:16Z

‎SandBox Security Model

KirstenS: /* SandBox Security Model */

2009-02-11T02:09:04Z

‎SandBox Security Model

KirstenS: /* Accessing JavaScript */

2009-01-29T01:32:56Z

‎Accessing JavaScript

KirstenS: /* Shared Objects */

2009-01-15T21:16:45Z

‎Shared Objects

KirstenS: /* Shared Objects */

2009-01-15T21:15:13Z

‎Shared Objects

@@ Line 1: / Line 1: @@
-[[OWASP Code Review Guide Table of Contents]]__TOC__
+{{LinkBar
 ==Flash Applications==
@@ Line 87: / Line 92: @@
 '''local-trusted''' -  A SWF must be hosted on the end-user's machine and the end-user must manually designate a folder to host local-trusted SWFs through the Flash Player settings manager.
 *May read from local files; read or send messages with any server; and script and any other SWF file.
 [[Category:OWASP Code Review Project]]

@@ Line 74: / Line 74: @@
 ==Permission Structure==
-'''Domain'''
+'''Domain''' - Domain sandboxes are in effect when a SWF is hosted on a web server.
-*Any two SWF files can interact within the same sandbox. They need explicit permission to read data from another sandbox.
+*Any two SWF files can interact when they are hosted on the same fully-qualified domain name (e.g. same-origin policy). They need explicit permission to read data from another sandbox.
 '''Local'''
 *local-with-filesystem (default) - can read from local files only
 *local-with-networking
@@ Line 83: / Line 84: @@
 **Send data to servers (e.g., using XML.Send() )
 '''local-trusted'''
 *May read from local files; read or send messages with any server; and script and any other SWF file.
 [[Category:OWASP Code Review Project]]

@@ Line 46: / Line 46: @@
 ==Accessing JavaScript==
-A parameter called allowScriptAccess governs if the Flash object has access to external scripts. It can have three possible values: '''never, same domain, always.'''
+A parameter called allowScriptAccess governs if the Flash object has access to external scripts. It can have three possible values: '''never, same domain, always.'''  The default value is '''sameDomain''' which means that the SWF must be hosted on the same FQDN as the calling HTML in order to have access to the HTML's DOM.  If allowScriptAccess is set to '''always''' then the SWF is granted access to the HTML's DOM regardless of where the SWF is hosted.
    <object id="flash007">
@@ Line 53: / Line 53: @@
     </embed>
    </object>
 ==Shared Objects==

@@ Line 81: / Line 81: @@
 '''local-trusted'''
-*May read from local files; read or send messages with any server; and script and any other SWF file
+*May read from local files; read or send messages with any server; and script and any other SWF file.
 [[Category:OWASP Code Review Project]]

← Older revision		Revision as of 02:09, 11 February 2009
Line 35:		Line 35:

	“The sandbox defines a limited space in which a Adobe Flash movie running within the Adobe Flash Player is allowed to operate. Its primary purpose is to ensure the integrity and security of the client’s machine, and as well as security of any Adobe Flash movies running in the player.”		“The sandbox defines a limited space in which a Adobe Flash movie running within the Adobe Flash Player is allowed to operate. Its primary purpose is to ensure the integrity and security of the client’s machine, and as well as security of any Adobe Flash movies running in the player.”
−

	Cross Domain Permissions: A Flash movie playing on a web browser is not allowed access that is outside the exact domain from which it originated. This is defined in the cross-domain policy file crossdomain.xml. Policy files are used by Flash to permit Flash to load data from servers other than its native domain. If a SWF file wishes to communicate with remote servers it must be granted explicit permission:		Cross Domain Permissions: A Flash movie playing on a web browser is not allowed access that is outside the exact domain from which it originated. This is defined in the cross-domain policy file crossdomain.xml. Policy files are used by Flash to permit Flash to load data from servers other than its native domain. If a SWF file wishes to communicate with remote servers it must be granted explicit permission:

← Older revision	Revision as of 12:37, 8 September 2010
(No difference)

@@ Line 33: / Line 33: @@
 '''local-trusted'''
 - Can read from Local files, communicate to any server and access any SWF file.
 “The sandbox defines a limited space in which a Adobe Flash movie running within the Adobe Flash Player is allowed to operate. Its primary purpose is to ensure the integrity and security of the client’s machine, and as well as security of any Adobe Flash movies running in the player.”
@@ Line 45: / Line 44: @@
 The API call System.security.loadPolicyFile(url) loads a cross domain policy from a specified URL which may be different from the crossdomain.xml file.
 ==Accessing JavaScript==

@@ Line 66: / Line 66: @@
   C:\Documents and Settings\<USER>\Application Data\Macromedia\Flash Player\#Shared Objects\<randomstring>\<domain>
-Shared objects are handled by the Flash application and not the clients' web browser.
+When cleaning the browser cache, Flash sharedobjects survive such an action.
-====Permission Structure====
+Shared objects are handled by the Flash application and not the client’s web browser.
 '''Domain'''
-*Any two SWF files can interact within the same sandbox. They need explicit permission to read data from another sandbox
+*Any two SWF files can interact within the same sandbox. They need explicit permission to read data from another sandbox.
 '''Local'''

@@ Line 57: / Line 57: @@
    </object>
-====Shared Objects====
+==Shared Objects==
-Shared Objects are designed to store up to 100kb of data relating to a users session.
+Shared Objects are designed to store up to 100kb of data relating to a user’s session. They are dependent on host and domain name and SWF movie name.
 They are dependent on host and domain name and SWF movie name.
 It is worth noting that they are also stored outside the web browser cache: