ACTIONSCRIPT 3 Developer’s Guide en

ACTIONSCRIPT 3.0 DEVELOPER’S GUIDE
Security
Accessing bitmap data
Flash Player 9 and later, Adobe AIR 1.0 and later
The draw() and drawWithQuality() (Flash Player 11.3; AIR 3.3) methods of a BitmapData object lets you draw the
currently displayed pixels of any display object to the BitmapData object. This could include the pixels of a MovieClip
object, a Bitmap object, or any display object. The following conditions must be met for these methods to draw pixels
to the BitmapData object:
In the case of a source object other than a loaded bitmap, the source object and (in the case of a Sprite or MovieClip
object) all of its child objects must come from the same domain as the object calling the draw method, or they must
be in a SWF file that is accessible to the caller by having called the Security.allowDomain() method.
In the case of a Loaded bitmap source object, the source object must come from the same domain as the object
calling the draw method, or its source server must include a URL policy file that grants permission to the calling
domain.
If these conditions are not met, a SecurityError exception is thrown.
When you load the image using the load() method of the Loader class, you can specify a context parameter, which
is a LoaderContext object. If you set the checkPolicyFile property of the LoaderContext object to true, Flash Player
checks for a URL policy file on the server from which the image is loaded. If there is a policy file, and the file permits
the domain of the loading SWF file, the file is allowed to access data in the Bitmap object; otherwise, access is denied.
You can also specify a checkPolicyFile property in an image loaded via an tag in a text field. For details, see
“Loading SWF files and images using the tag in a text field” on page 1050.
Accessing sound data
Flash Player 9 and later, Adobe AIR 1.0 and later
The following sound-related ActionScript 3.0 APIs have security restrictions:
The SoundMixer.computeSpectrum() method—Always permitted for code running in the same security
sandbox as the sound file. For code running in other sandboxes, there are security checks.
The SoundMixer.stopAll() method—Always permitted for code running in the same security sandbox as the
sound file. For files in other sandboxes, there are security checks.
The id3 property of the Sound class—Always permitted for SWF files that are in the same security sandbox as the
sound file. For code running in other sandboxes, there are security checks.
Every sound has two kinds of sandboxes associated with it—a content sandbox and an owner sandbox:
The origin domain for the sound determines the content sandbox, and this determines whether data can be
extracted from the sound via the id3 property of the sound and the SoundMixer.computeSpectrum() method.
The object that started the sound playing determines the owner sandbox, and this determines whether the sound
can be stopped using the SoundMixer.stopAll() method.
When you load the sound using the load() method of the Sound class, you can specify a context parameter, which
is a SoundLoaderContext object. If you set the checkPolicyFile property of the SoundLoaderContext object to true,
the runtime checks for a URL policy file on the server from which the sound is loaded. If there is a policy file, and the
file permits the domain of the loading code, the code is allowed to access the id property of the Sound object;
otherwise, it will not. Also, setting the checkPolicyFile property can enable the SoundMixer.computeSpectrum()
method for loaded sounds.
Last updated 6/6/2012
1055