Accessibility

Flash Player Article

 

Creating more secure SWF web applications


Peleus Uhley

Peleus Uhley

Adobe

Table of Contents

  1. Introduction
  2. Potential threats to SWF files
  3. Selecting more secure compiler settings
  4. Setting security controls within the HTML code
  5. Loading remote content
  6. Complex cross-domain implementations
  7. Communicating between SWFs and across domains
  8. Communicating through a shared resource
  9. Validating data from remote sources
  10. Safely displaying content in text fields and drawable regions
  11. Exception handling
  12. Encrypting data
  13. Developer checklists
Created:
20 December 2007
User Level:
Intermediate
Products:
Flash Player
Flash
Flex

Adobe frequently updates the Flash Player software security model to improve the security of the Flash Player environment. However, that only addresses half of the overall solution to help securely deploy applications that run in Flash Player. As the web developer, you must also correctly leverage the tools provided by the ActionScript language and the Flash Player platform to help ensure that your SWF files are more secure. Poor programming conventions can expose SWF files and the sites that host them to web attacks. Adobe provides many resources to developers such as their Secure Programming Guide to assist with developing more secure code.

This article outlines many of the security considerations associated with common tasks and provides samples of techniques that can be used to help secure code against those threats. Links to the full documentation are provided throughout the article for further reference.  These techniques are designed primarily for the Flash Professional development environment but they can also be applied by Flex developers.

Requirements

To get the most out of this article you will need to install the following software:

Flash CS3 Professional (optional)

Flex Builder 3 beta (optional)

Flash Player 9 Update 3 (9,0,115,0) or later

Prerequisite knowledge

You should have an understanding of ActionScript 2.0, ActionScript 3.0, and Flash Player. Knowledge of Flash Professional or Flex is encouraged but not required.

Page 1 of 13
Next Page

About the author

Peleus Uhley is a senior security researcher within the Secure Software Engineering team at Adobe. His primary focus is assisting with Adobe platform technologies, including Flash Player and Adobe AIR. Prior to joining Adobe, Peleus started in the security industry as a developer for Anonymizer, Inc., and went on to be a security consultant for companies such as @stake and Symantec.