Although Adobe AIR provides a full browser implementation
via WebKit, there's a distinct difference between what JavaScript should be
allowed in the browser, and what should be allowed on the desktop. Keeping in
mind that Adobe AIR provides native file IO, you can imagine something like eval(
air.File.resolvePath( 'reallyimportant.sys' ).deleteFile() ) doing irreparable damage to an operating system. In order to address this type
of scenario, Adobe AIR provides a number of additional security features that
go above and beyond what the browser offers.
Although this article isn't going to address security within Adobe AIR at length, it's important to know that there are two security sandboxes: The application sandbox and the non-application sandbox. The non-application sandbox operates just like the browser, and doesn't give access the Adobe AIR APIs. The application sandbox has full access to the Adobe AIR APIs, but places certain restrictions on the JavaScript that can be executed. Some of these restrictions directly impact the Yahoo! Maps API.