允许 Flash 影片与包含窗口通信而不暴露完整的外部接口？
我正在开发一个允许管理员上传任意 SWF 并将其嵌入页面的网站。理论上，管理员是值得信任的，但我仍然希望防止潜在的恶意管理员或受误导的管理员损害网站。
该站点的部分功能是 SWF 可以在完成后与包含的浏览器页面进行通信并让页面做出反应。
现在，我可以想到两种方法来执行此操作：
- 使用
ExternalInterface.addCallback创建一个名为isComplete之类的全局回调，该回调执行逻辑并返回 true 或 false，具体取决于是否Flash 应用程序处于完成状态。然后，只需执行类似setTimeout的操作即可重复调用该函数。我认为这不需要我打开电影的allowscriptaccess。 - 使用
allowscriptaccess嵌入影片，并让影片在完成时调用类似ExternalInterface.call('done')的内容。此选项似乎需要我打开allowscriptaccess，这是一个潜在的威胁，因为我无法控制嵌入该指令的 SWF。
我是否缺少一个不涉及无限循环并且不需要我公开安全风险的解决方案？
I'm working on a site that allows administrators to upload arbitrary SWFs and embed them on the page. Administrators are in theory trusted, but I still want to protect against potentially malicious administrators or misguided administrators from harming the site.
A part of the functionality of the site is that the SWFs can communicate to the containing browser page when it's finished and for the page to react.
Now, I can think of two ways to do this:
- Use
ExternalInterface.addCallbackto create a global callback named something likeisCompletethat does logic and returns true or false depending on whether the Flash app is in a completed state. Then, just do something likesetTimeoutto just call that function repeatedly. I don't think this would require me to open upallowscriptaccessto the movie. - Embed the movie with
allowscriptaccessand have the movie call something likeExternalInterface.call('done')when it's finished. This option seems like it requires me to open upallowscriptaccess, which is a potential threat since I can't control the SWFs that would be embedded with this directive.
Is there a solution I'm missing that doesn't involve doing the infinite loop and also doesn't require me to open up a security risk?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
不要将 SWF 直接嵌入到主页中，而是将它们嵌入到托管在子域（或某些其他域）上的单独页面中。然后，通过主页中的
显示该子页面。这样，您将拥有一个跨域。继续并授予 SWFallowscriptaccess权限。然后，通过postMessage（或跨浏览器模拟脚本）与 iframe 进行通信。这样，SWF 就可以对页面做任何他们想做的事情，但到主页只有一个受控的“隧道”。Instead of embedding your SWFs directly in the main page, embed them in a separate page that's hosted on a subdomain (or some other domain). Then, display that subpage via an
<iframe>in your main page. This way, you'll have a cross-domain<iframe>. Go ahead and give the SWFallowscriptaccesspermissions. Then, communicate viapostMessage(or a cross-browser simulation script) with the iframe. This way, the SWF can do anything they want to the page, but there's only one controlled "tunnel" to the main page.