SWF 托管安全
我已经开始在 as3 中开发绘图应用程序。我想我可以集成一个 cms 并允许 swf 文件在运行时作为图形上传。这里涉及第三方可能恶意的 swf 文件的潜在安全问题是什么？
我只需将 swf 作为自定义精灵类添加到蒙版容器精灵中即可。 这是否会打开一个漏洞来运行其他脚本（另一台服务器上的 js？），或者以不安全的方式访问客户端计算机？
我将不胜感激任何有关 swf 托管的推荐阅读和/或建议/经验。我看到现在许多网站都在这样做，例如 Wonderfl 和 activeden。
I have started developing a drawing application in as3. I am thinking that I could integrate a cms and allow swf files to be uploaded in runtime as graphics.What are the potensial security issues involving third party possibly malicious swf files here?
I would simply be adding the swf as a custom sprite class to a masked container sprite.
Does this open a hole to run other scripts ( js on another server? ) and or give access to the client's computer in unsafe ways?
I would appreciate any recomendations reading and or advice / experience in swf hosting like this. I see this being done on many sites now such as wonderfl and activeden.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
这是相当于 XSS 的 ActionScript。您的域名将不再受同源政策的保护。攻击者可以利用它来劫持会话 ID (Cookie)、破坏您的网站或向访问您网站的任何浏览器传送漏洞利用代码。
This is the ActionScript equivalent to XSS. Your domain will no longer be protected by the Same Origin Policy. This can be used by an attacker to hijack a Session ID (Cookie), deface your web site, or deliver exploit code to any browsers visiting your site.
我认为与其在服务器上保存一堆乱七八糟的 SWF，不如序列化绘图数据，然后让主 SWF 根据加载的数据重新绘制绘图。您仍然可以使用 CMS/数据库来存储和管理此数据。
编辑*
如果您需要加载 SWF，请查看 指定加载上下文。也许还可以阅读 加载内容。
I think instead of saving a whole mess of SWFs on the server, it would be better to serialize your drawing data, and have your main SWF just redraw the drawing based on the loaded data. You can still use a CMS/Database to store and manage this data.
EDIT*
If you need to load SWFs, take a look at Specifying loading context. And maybe also take a read through Loading Content.