我可以禁止用户通过AS3 / Flash Loader.load()加载swf文件而只允许加载图像吗？
我想让 AS3 应用程序从用户提供的 url 加载图像。但我不希望恶意用户能够加载 SWF 文件来代替图像，例如使用更改后的扩展名“maliciousSwf.png”。好吧，不确定安全威胁有多大，超出了黑客反编译 swf 的能力，但我认为理想情况下不应允许这种行为。
那么，有什么办法可以防止这种情况发生呢？当人们允许用户在 Flash 应用程序中加载图像时，他们是否会以某种方式防止加载 SWF？或者这真的没什么大不了的吗？
I want to have an AS3 app load images from url supplied by the user. But I don't want a malicious user to be able to load an SWF file in place of the image, such as with an altered extension "maliciousSwf.png". Well, not sure how big a security threat that is above and beyond the ability of the hacker to decompile swf, but I think that ideally such behavior should not be allowed.
So, is there any way to prevent this? When people allow users to load images in their Flash apps, do they somehow guard against loading of SWF? Or is this really absolutely no big deal?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
您只需要确保用户加载的文件作为您的主应用程序加载到单独的安全域中。那么他们的代码将无法覆盖你的任何代码。如果你想更加安全，还可以在加载区域上放置一个内容遮罩，这样它们的内容就不会超出其边界框。
You just need to make sure user loaded files are loaded into a separate security domain as your main application. Then their code will not be able to override any of yours. If you want to be extra safe, also put a content mask on the loading area, so that their content can not extend out of its bounding box.