You can use the SoundMixer.areSoundsInaccessible() method to find out whether a call to the SoundMixer.stopAll() method would not stop all sounds because the sandbox of one or more sound owners is inaccessible to the caller.
Calling the SoundMixer.stopAll() method stops those sounds whose owner sandbox is the same as that of the caller of stopAll() . It also stops those sounds whose playback was started by SWF files that have called the Security.allowDomain() method to permit access by the domain of the SWF file calling the stopAll() method. Any other sounds are not stopped, and the presence of such sounds can be revealed by calling the
SoundMixer.areSoundsInaccessible() method.
Calling the computeSpectrum() method requires that every sound that is playing be either from the same sandbox as the object calling the method or from a source that has granted permission to the caller's sandbox; otherwise, a SecurityError exception is thrown. For sounds that were loaded from embedded sounds in a library in a SWF file, permission is granted with a call to the Security.allowDomain() method in the loaded SWF file. For sounds loaded from sources other than SWF files (originating from loaded MP3 files or from Flash video), a cross-domain policy file on the source server grants access to data in loaded media. You cannot use the computeSpectrum() method if a sound is loaded from RTMP streams.
For more information, see “Author (developer) controls” on page 460 and “Website controls
(cross-domain policy files)” on page 456 .
Accessing video data
You can use the BitmapData.draw() method to capture the pixel data of the current frame of a video.
There are two different kinds of video:
■
■
RTMP video
Progressive video, which is loaded from an FLV file without an RTMP server
You cannot use the BitmapData.draw() method to access RTMP video.
When you call the BitmapData.draw() method with progressive video as the source parameter, the caller of BitmapData.draw() must either be from the same sandbox as the
FLV file, or the server of the FLV file must have a policy file that grants permission to the domain of the calling SWF file. You can request that the policy file be downloaded by setting the checkPolicyFile property of the NetStream object to true .
476 Flash Player Security
Loading data
SWF files can load data from servers into ActionScript, and send data from ActionScript to servers. Loading data is a different kind of operation from loading media, because the loaded information appears directly in ActionScript, rather than being displayed as media. Generally,
SWF files may load data from their own domains. However, they usually require crossdomain policy files in order to load data from other domains.
Using URLLoader and URLStream
You can load data, such as an XML file or a text file. The load() methods of the URLLoader and URLStream classes are governed by cross-domain policy file permissions.
If you use the load() method to load content from a domain other than that of the SWF file that is calling the method, Flash Player checks for a cross-domain policy file on the server of the loaded assets. If there is a cross-domain policy file, and it grants access to the domain of the loading SWF file, you can load the data.
Connecting to sockets
Cross-domain access to socket and XML socket connections is disabled by default. Also disabled by default is access to socket connections in the same domain as the SWF file on ports lower than 1024. You can permit access to these ports by serving a cross-domain policy file from any of the following locations:
■
■
■
The same port as the main socket connection
A different port
An HTTP server on port 80 in the same domain as the socket server
If you serve the cross-domain policy file from same port as the main socket connection, or in a different port, you enumerate permitted ports by using a to-ports attribute in the crossdomain policy file, as the following example shows:
<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy
SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<!-- Policy file for xmlsocket://socks.mysite.com -->
<cross-domain-policy>
<allow-access-from domain="*" to-ports="507" />
<allow-access-from domain="*.example.com" to-ports="507,516" />
<allow-access-from domain="*.example.org" to-ports="516-523" />
<allow-access-from domain="adobe.com" to-ports="507,516-523" />
<allow-access-from domain="192.0.34.166" to-ports="*" />
</cross-domain-policy>
Loading data 477
To retrieve a socket policy file from the same port as a main socket connection, simply call the
Socket.connect() or XMLSocket.connect() method, and, if the specified domain is not the same as the domain of the calling SWF file, Flash Player automatically attempts to retrieve a policy file from the same port as the main connection you are attempting. To retrieve a socket policy file from a different port on the same server as your main connection, call the
Security.loadPolicyFile() method with the special "xmlsocket" syntax, as in the following:
Security.loadPolicyFile("xmlsocket://server.com:2525");
Call the Security.loadPolicyFile() method before calling the Socket.connect() or
XMLSocket.connect() method. Flash Player then waits until it has fulfilled your policy file request before deciding whether to allow your main connection.
If you are implementing a socket server and you need to provide a socket policy file, decide whether you will provide the policy file using the same port that accepts main connections, or using a different port. In either case, your server must wait for the first transmission from your client before deciding whether to send a policy file or set up a main connection. When Flash
Player requests a policy file, it always transmits the following string as soon as a connection is established:
<policy-file-request/>
Once the server receives this string, it can transmit the policy file. Do not expect to reuse the same connection for both a policy file request and a main connection; you should close the connection after transmitting the policy file. If you do not, Flash Player closes the policy file connection before reconnecting to set up the main connection.
For more information, see “Socket policy files” on page 458 .
Sending data
Data sending occurs when ActionScript code from a SWF file sends data to a server or resource. Sending data is always permitted for network domain SWF files. A local SWF file can send data to network addresses only if it is in the local-trusted or local-with-networking sandbox. For more information, see “Local sandboxes” on page 462 .
You can use the flash.net.sendToURL() function to send data to a URL. Other methods also send requests to URLs. These include loading methods, such as Loader.load() and
Sound.load() , and data-loading methods, such as URLLoader.load() and
URLStream.load() .
478 Flash Player Security
