ACTIONSCRIPT 3 Developer’s Guide en

ACTIONSCRIPT 3.0 DEVELOPER’S GUIDE
Security
An HTML page may also use a script to generate SWF-embedding tags. You need to alter the script so that it inserts
the proper allowNetworking settings. HTML pages generated by Adobe Flash Professional and Adobe Flash Builder
use the AC_FL_RunContent() function to embed references to SWF files. Add the allowNetworking parameter
settings to the script, as in the following:
AC_FL_RunContent( ... "allowNetworking", "none", ...)
The following APIs are prevented when allowNetworking is set to "internal":
navigateToURL(), fscommand(), ExternalInterface.call()
In addition to the APIs on the previous list, the following APIs are also prevented when allowNetworking is set to
"none":
sendToURL(), FileReference.download(), FileReference.upload(), Loader.load(),
LocalConnection.connect(), LocalConnection.send(), NetConnection.connect(), NetStream.play(),
Security.loadPolicyFile(), SharedObject.getLocal(), SharedObject.getRemote(), Socket.connect(),
Sound.load(), URLLoader.load(), URLStream.load(), XMLSocket.connect()
Even if the selected allowNetworking setting permits a SWF file to use a networking API, there may be other
restrictions based on security sandbox limitations (see “Security sandboxes” on page 1033).
When allowNetworking is set to "none", you cannot reference external media in an tag in the htmlText
property of a TextField object (a SecurityError exception is thrown).
When allowNetworking is set to "none", a symbol from an imported shared library added in the Flash Professional
(not ActionScript) is blocked at run time.
Full-screen mode security
Flash Player 9 and later, Adobe AIR 1.0 and later
Flash Player 9.0.27.0 and later support full-screen mode, in which content running in Flash Player can fill the entire
screen. To enter full-screen mode, the displayState property of the Stage is set to the
StageDisplayState.FULL_SCREEN constant. For more information, see “Working with full-screen mode” on
page 167.
For SWF files running in a remote sandbox, there are some security considerations.
Last updated 6/6/2012
1046