Adobe has announced security changes and enhancements that will roll out with an upcoming security update to Flash Player 9. The Adobe Developer Connection has an article detailing the changes and who is impacted. If any of the following bullets is applicable to you, please be sure to read the article as your content may be affected.

  • You use sockets or XMLSockets, regardless of the domain you are connecting to
  • You use addRequestHeader or URLRequest.requestHeaders in any network API call when sending or loading data cross-domain
  • You provide access to content on remote domains as a web service provider
  • You have SWFs that are exported for Flash Player 7 (SWF7) or below that communicate with the hosting HTML by any means
  • You use “javascript:” through network APIs to communicate outside a SWF

Keep in mind that the descriptions above are meant to capture a broad group of people. The affected areas are tailored to keep normal usage as unaffected as possible. For instance, while the last bullet tries to capture anyone using “Javascript:,” the actual change only involves “Javascript:” being used in ways that I haven’t encountered before. Normal uses through getURL and navigateToURL will be unaffected.

Also, if you are asking yourself, “Didn’t I just hear about socket policies back in December?,” you’d be right. With Flash Player 9.0.115, a two phased approach was announced for authorizing socket policy files. Phase 1 was implemented with 9.0.115, and phase 2 will be rolled out in the April release. By doing a slow rollout of this new authorization process, we wanted to give developers the time they needed to make changes to affected content before their users have a player that enforces the new policies.

While you are in a security frame of mind, I’d like to point out another article that is on the Adobe Developer Connection. Peleus Uhley, senior security researcher at Adobe, wrote an article on development practices for creating secure SWFs that should be required reading for any ActionScript developer.

The Flash Player team works hard to ensure security within the player, but how you design your application is just as important. The flow of data through an application, the configuration of network and script permissions and even where you host your SWF can raise or lower the exposure to your server. Peleus’s article can provide advice that will be valuable to even seasoned ActionScript developers.