ACTIONSCRIPT 3 Developer’s Guide en

ACTIONSCRIPT 3.0 DEVELOPER’S GUIDE
Communicating with native processes in AIR
However, validating input can be difficult. To avoid such difficulties, it is best to write a native application (such as an
EXE file on Windows) that has specific APIs. These APIs should process only those commands defined by the
application. For example, the application may accept only a limited set of instructions via the standard input stream.
AIR on Windows does not allow you to run .bat files directly. The command interpreter application (cmd.exe)
executes Windows .bat files. When you invoke a .bat file, this command application can interpret arguments passed to
the command as additional applications to launch. A malicious injection of extra characters in the argument string
could cause cmd.exe to execute a harmful or insecure application. For example, without proper data validation, your
AIR application may call myBat.bat myArguments c:/evil.exe. The command application would launch the
evil.exe application in addition to running your batch file.
Last updated 6/6/2012
840