Flash AS3 - URLLoader cant load binary data from different domain

2
votes

Two important points. 1 - SWF must have ability to loading binary data from any domain. 2 - SWF cant load policy XML file from url, cause upload form allows me only to upload swf files, so I cant include any other data. I tried:

Security.allowDomain("*");

But it works only for SWF files. I tried to embed policy XML file:

var dataXML:XML = 
<?xml version="1.0"?> 
<!-- http://www.foo.com/crossdomain.xml --> 
<cross-domain-policy> 
    <allow-access-from domain="*" /> 
</cross-domain-policy>;

But Security.loadPolicyFile(url:String) allows only to set file url, not data. So my question is, how can I allow SWF to load binary files from different domains without having any additional file? URLLoader code:

var request:URLRequest = new URLRequest("http://differentdomain.com/binaryfile.dat");
var words:URLLoader = new URLLoader(); 
words.dataFormat = URLLoaderDataFormat.BINARY; 
words.addEventListener(Event.COMPLETE, prepareFile);
words.addEventListener(IOErrorEvent.IO_ERROR, loadError);
words.addEventListener(SecurityErrorEvent.SECURITY_ERROR, secureError);
words.load(request);

This will make an security error, if file is from different domain than SWF file. Thanks for any help.

Its possible to get binary data from JavaScript using ExternatInterface in AS3 code. Here is cross-browser library for reading files binary: binary reader and later version jDataView Hope this will help someone. Thanks to Jonatan Hedborg for idea.

4
actionscript-3
To load a file from aaa.com you need to load the crossdomain.xml from aaa.com/crossdomain.xml else it may not work. - Adrian Pirvulescu
It looks like a joke for me. Any other language allows to download binary data from any place, but not AS3? - speedy
It's a security issue, and it's just how it is. The only way around it would be to set up a proxy server that you can relay your requests through. Also note that for example silverlight has an even stricter restriction on crossdomain loading, so it's not the only language with this quirk. - Jonatan Hedborg
No solution if I cant upload anything other than only SWF file and also if I want my SWF to be indepedent from any additional php scripts on external servers? I dont understand - If wget on linux server, php , any download software or swf loaded locally can do it, why swf running under domain cant. We can load flash known media files and nothing more. I spent a real lot of hours on making first MIDI player in flash technology which can play midi and karaoke files from pasted url, and now its totally unuseful - I want it script/server independent. - speedy
It might be possible to hack something up with ExternalInterface and load the file via AJAX, but most people just set up a proxy server to load arbitrary files. There might be a service you can get for this so you don't have to set up your own? I'm not sure what you expect us to do about this - it's a security feature/limitation of flash, and not likely to change. - Jonatan Hedborg

4 Answers

2
votes

You should read this before : http://kb2.adobe.com/cps/142/tn_14213.html

And you can use a proxy script, search on google/stackoverflow you'll find a lot of answers...

1
votes

Take a look at this: http://wonderfl.net/c/gJXA

Some trick which works with any binary data from any domain, without need to use ajax or own proxy script (sometimes you dont have possibility to upload php scripts).

0
votes

Flash is control that most commonly used by HTML pages. As result it needs to follow security restrictions places on other (i.e. JavaScript) objects on the same page. Web pages use same origin security policy - objects on a page can't read data from domains different from domain of the current page.

There are cases when servers for other domains allow such access. I.e. in Flash case it is crossdomain.xml, similar policy file exist for Silverlight, there are several ways to handle it for JavaScript including JSONP.

Incorrect usage of ways to bypass same origin policy leads to cross-site scripting issues on your site/page that host your control which often leads to leaking personal information.

0
votes

I had to tackle a similar problem a while ago and managed to make use of UrlStream to load the target SWF's bytes at runtime.

gist: https://gist.github.com/1988661