Javascript :: Flash - Security / Protecting Code In JavaScript?
May 10, 2010
With all the recent hype about JavaScript and HTML5 replacing Flash, I wanted to know - How would it be possible to protect client-side js code? Of course, it is possible to obfuscate it, but that would only make it a little harder. Also, for games which submit high scores to the server, wouldn't it be incredibly easy to modify those scores before they are sent to the server? I know even Flash files can be decompiled, but they can be obfuscated and flash decompilation is not as easy as modifying data in JS - could be done easily using a plugin such as Firebug. I'd like to know everyone's views on this.
View 2 Replies
Similar Posts:
Feb 6, 2011
Aside from using browser headers, I want to blacklist/whitelist browser and plugins from my site so that I can prevent these older unpatched systems from (1) being a general user of my site (2) removing those 'targets' from would-be-attackers reach.Is there a standard way to use Whitelisting or Blacklisting to control browser access to my site? For example, I want to prevent any browser that has outdated Flash, but I want to permit them if they have no Flash at all.
View 1 Replies
Nov 4, 2010
I mixed a.com and b.com in my original post, I'll try to rephrase stuff correctly:
A HTML page is loaded from a.com
The HTML embeds a Flash client from b.com
HTML contains a Javascript function that makes a connection to a.com, ie the origin of the HTML, not the origin of Flash
The Flash calls that Javascript function
Question: Do I need to have a crossdomain.xml in a.com?
View 2 Replies
Jan 22, 2011
I'm looking for a workaround to the "AdSense does not let you choose only images but no flash" issue. I'm rather a newbie to JS, but is there any way for one script to prevent other scripts embedded in a site from detecting the presence of the flash plugin? Even if it doesn't work with AdSense, it would be nice to know if there's a hack to do this that might work in other settings.By the way, I suppose I wouldn't care if it failed to work on IE or obsolete browser versions.
View 1 Replies
Mar 14, 2010
I have a swf hosted at domain A, and I have a html at domain B My swf is able to be loaded from accessing the html at domain B. However, the swf gets a SecurityError: Error #2060: Security sandbox violation:
[Code]...
View 1 Replies
Jun 18, 2010
I've a developer which has given users the ability to download a zip archive which contains an html document which references a relative javascript file and flash document.The flash document accepts as one of it's parameters a url which is embedded in the html document. I believe that this archive is meant to be used as a means to transfer an advertisement to someone who would use the source to display the ad on their site, however the end user appears to want to view it locally.When one opens the html document the flash document is presented and when the user clicks on the flash document it redirects to this embedded url. However, if one extracts the archive on the desktop and opens the html document in a browser and clicks the flash object, nothing observable happens, they will not be redirected to the external url.
I believe this is a security risk because one is transferring from the local computer zone to an external zone.I'm trying to determine the best way to explain this security risk in the simplest of terms to a very end user. They simply believe it's "broken" when it's not broken, they're being protected from a known vulnerability.The developer attempted to explain how to copy the files to a local iis instance, which I highly doubt is running on the users machine, and I do not consider this to be a viable explanation.
View 2 Replies
Dec 28, 2011
We've just developed a small Facebook puzzle that people win some gifts from our customer. I'd like to ask a few questions since I'm pretty stuck despite tried lots of things. First I'd like to write what we have and then will explain our problems.oot of application (/) checks for signed_request in POST params, extracts information from it to see if we've registered the logged in user into our database. This checks are also used to understand if the request is sent from Facebook or not to prevent requests coming outside of Facebook. (will write why we want this)Once the application is successfully rendered, Facebook JS API takes place, does its checks and sets the fbsr cookie. We use that cookie information while processing ajax requests to check if the request really belongs to the logged in user (e.g.: scores being sent for a user belong to the logged in user).
We implemented CSRF protection and another protection to check if the requests are POST and more specifically AJAX requests and return 40x if not.nd out that some people seem to take advantage of this bug.One way I thought of is to ignore all requests except coming from Facebook. Since the ajax requests are blocked (cross site) we should have been safe. However this leaded to another problem that, once we redirect users to e.g. leaderboard the signed_request data is lost and our index page returns 40x once the user tries to go back since our application thinks that the user tries to visit our application outside of Facebook.
View 1 Replies
Jan 29, 2012
I need to execute some javascript string code from flash swf file using actionscript 3.
I read that it could be done by passing the javascript code to the parent html document , using externalinterface.call function. Then I assume it will be faster if I can declare functions in the javascript code in the HTML document in the first use of externalinterface.call funtion ; if flash code calls the javascript code repeatedly. So let me ask you how to do that. For details , any javascript to be loaded is unknown in design time and I can not prepare a javascript file to be loaded.
View 2 Replies
Sep 29, 2010
Is it possible to pass file names from a running Flash application, which only purpose is to enable multiple-file-selection, to a JavaScript application which handles upload of all files to the server?I have examined various Flash upload solutions (like SWFUpload, Uploadify, etc.) and none of them meets my needs. I want an easy to implement solution (like Uploadify) which also lets me specify various parts of the HTTP request.
The reason I need this is because my upload form uses session cookies (for user authentication) and an CSRF token both passed to the server when uploading files.Is it technically possible to pass filenames (+ paths) to a JavaScript application which then handles the upload?
View 1 Replies
May 20, 2011
Here's the challenge: I have a Flash movie which will be embedded in a page using an unknown DOM ID that I want to be able to identify/store for callback in a JS function. My ideal user flow would be: User clicks button in Flash. Flash pauses any animations / video / sounds / etc. Flash calls an injected JS function to display a page-covering overlay experience. When user closes overlay experience, a callback method on the Flash object is called. Flash resumes playback.
The problem is, when AS3 uses the ExternalInterface.call("functionName", args...) method, there doesn't seem to be a DOM event triggered, and thus it is impossible to tell which object called a JS function, so having a "registerMe()" function doesn't seem to work. Basically, the injected JS function has no way to determine which DOM object to call, because the ID of the Flash object is unknown.
[Code]...
View 3 Replies
Apr 16, 2009
I'd like to call a javascript function from an embedded .swf file. Specifically, I'd like to call a function in one of my externally linked javascript files from within: function loadTrack(){
[Code]...
which is in an .as file which I assume somehow becomes the swf file. How would I go about this and 're-compile' the .as file?
View 3 Replies
Oct 2, 2011
I'm trying to write a web application that searches google and then downloads the result sites and parses them.The search has to be done on the client side. Without implementing a server side proxy.Can this be done using javascript/sliverlight/flash?
View 1 Replies
Feb 29, 2012
let suppose i have a object named "data" which has a callBack function named "closeItem" which does something. So i have flash file which has a close button. on click of that i am calling this function which closes this item. So issue is? If i pass this "closeItemFunction" as global function this works fine. but if a pass this function as a "data.closeItem" this doesn;t work throwing some falsh error. so i just wanna ask that "does flash only call gobal scoped javascript function" ??
View 2 Replies
Feb 5, 2010
I'm trying to access a swf function from javascript using External Interface given by adobe and I get the following error.
SecurityError: Error #2060: Security sandbox violation: ExternalInterface caller http://media.varheroes.com/flash/flashtest.swf cannot access http://apps.facebook.com/feline-frenzy/flashtest/.
at flash.external::ExternalInterface$/_initJS()
at flash.external::ExternalInterface$/addCallback()
at flashtest_fla::MainTimeline/frame1()
View 2 Replies
Jun 12, 2010
I need to achieve something like this for my website: Flash Rain Effect
Is that possible to do in Javascript? I want it to be just as smooth as it is in Flash.
View 3 Replies
Dec 19, 2010
I have a flash file that contains a package "game" which has a class "Scores" and a method setValue(). I want to write some lines of Javascript that allow me to call that method. Someone directed me to this tutorial, but I am still a bit confused.
Javascript: alert("start"); var so; so = document.embeds[0];
so.addParam("allowScriptAccess","always"); import flash.external.ExternalInterface;
ExternalInterface.call("setValue[2600]");
displays an alert to tell me that it has indeed began to execute saves the embedded flash file into a variable and sets access imports that class calls the method.I am not sure about how this class thing works? This is just the bits and pieces I was able to come up with from that site, but I don't really understand how it all works (but certainly hope to eventually).This is the site: http:[url]...how-do-i-access-flash-function-using-javascript.When I execute the code with the importation nothing happens, but the alert does come up when I don't have that statement?
View 1 Replies
Jan 4, 2011
I'm searching for free partial panorama viewer. It should be placed in somewhere in the page and it should be customizable (openSource?). So far i found pan0.net but it only supports 360 and i have priority for non 360...
View 2 Replies
Aug 5, 2011
I'm wondering if its possible to do what I'm thinking, and if it is possible, does anyone know of a flash object that does what I need? I know a Flash object can provide a javascript API to interact with it, what I dont know is can Flash send an email directly without the need to talk to the webserver to do so? If thats possible would it not be possible to write a flash object that did nothing but provide an API to send emails? Has such a thing been created that is out there for others to use?
I'm looking to create a email form on a web page but the site is static (no server scripting). In my situation server scripting is not possible as there is no server, the site is 100% client side on a CD/DVD/USB Stick.
View 4 Replies
Feb 10, 2012
when I moved my mouse there was a red fluid like velvet effect that followed my mouse and slowly faded.It was really cool and would love to add it to my website.
View 1 Replies
Apr 4, 2010
i have this javascript tracking-code I need to place in our flash-banner in order for our third-party tracking company to track clicks and that sort of stuff, but I'm not sure how I need to place it in our flash-banner. I thought I coudl simply place this javascript into a top layer or the like, but seems I cannot directly include it like that inside Flash. Then I thought perhhaps I could simply save the javascript file as .js file and call it from within the Flash file, but not sure how to go about it...
Here below is the javascript in question:
Code:
<!-- START::ib-ibi.com View Tag; DO NOT MODIFY TAG-->
<script type="text/javascript">
var _ibHost = "https://";
[code]....
View 2 Replies
Jun 19, 2011
With regular HTML it's possible to change the look of the page and to make new cookies using javascript simply by typing it into the address bar and hitting enter.But what about flash videos.Is there a way to preform some action on the video on the page using javascript in the address bar?
View 2 Replies
Feb 16, 2011
Is it possible to make desktop Air application by using HTML/JavaScript and Flash?Actually I want to make an Air app (which is for desktop) by using flash and want to use HTML , javascript and CSS as well.Is it possible ?
View 1 Replies
Apr 1, 2010
Is there any way to execute arbitrary code in Flash, like javascript's eval()? I'd like to take some code as a string and execute it, if possible
View 2 Replies
Feb 17, 2011
I actually have two websites on the same domain. say, for example[URL]..flashsite contain the website that is fully flash based while the other is an html based with no flash. what i want is that, if somebody visits my url on [URL]..the javascript should first detect if the plugin is installed in his browser. if yes, then it should take me directly to the "flashsite" folder, and if not, then it should, by default, load the html website.
View 2 Replies
Oct 24, 2009
I am looking for a flash mp3 player that will work within the Opera-based browser on the Wii. The player needs to be javascript enabled (support methods like play, stop etc.) The mp3 tracklist will be built dynamically using ajax on the same page as the player so it must trigger an event when a track finishes playing (or at least provide functionality of some kind to indicate that it's time to start the next track). Does anyone know of such a player?
[Code]...
View 4 Replies
May 2, 2011
The following doesn't work (although it gives no explicit error), but why not?nd... Is there really no way around it, strictly using the with statement? Forget using for / foreach.
with (object1, object2) {
attribute = value;
method();
}
Why the code above gives no syntax error, doesn't work but is accepted by with?If it's possible, how could we change multiple objects with same attribute using with?
var object1 = { attribute: 3 };
var object2 = { attribute: 2, method: function() { alert('blah'); } };
var object3 = { method: function() {alert('bleh'); } };
[code]....
View 2 Replies
Aug 1, 2009
for some reason, whenever I dynamically load a swf on a $(document).ready() by writing to a div, I am unable to make javascript calls to the browser. Specifically, all calls to the browser return "null". This does not occur when embedding the swf normally on the page load, but I would like to prevent loading of the swf until a specified point in time.
What the heck is going on here? Is there something special about dynamically embedding a swf that prevents the swf from talking to the browser? The methods ARE called (I've proven such by showing alerts), but all return values to any function, regardless of type returned, shows as null when it gets to flash.
View 3 Replies
Aug 26, 2011
i have a flash movie with 2 frames. and i would like to call an external javasscript function on frame action.
[Code]...
View 2 Replies
Oct 23, 2009
We're currently building a Flex application using the PureMVC framework with a shell.swf which loads/unloads modules dynamically. We're experiencing issues with memory and we're looking to replace the shell.swf with a JavaScript-based loader.Two questions:What would be a good framework to dynamically load the Flex components and allow the modules to communicate between each other?Would dynamically loading/unloading the modules via JavaScript take care of the typical memory problems associated with Flex/Flash applications?
View 1 Replies
Dec 4, 2011
I have the following class, I want to do what is in the comments.I know I can do it with conditionals.I'd like to know if there is a way of doing that dinamicaly.This code is in AS3, but I know maybe this is related to javascript because AS3 is based on ECMAScript
public class ClientStatus
{
public static const INVITED:int = 0;[code].....
View 2 Replies
