Security Changes Affect 3rd Parties

For those of you who haven’t had the opportunity to experiment with Flash MX in depth yet, there are some things you should to know about changes in the functionality of Flash MX projectors courtesy of the new Flash 6 Players Security Sandbox.

1. A quick test shows that the SAVE command that existed in Flash 5 no longer works in Flash MX projectors.

2. The Flash MX stand-alone player (SAFlashPlayer.exe) now restricts the use of the EXEC command (details below).

Files you want to EXEC in Flash MX have to be in a directory called “fscommand” at the same level as the projector. You don’t specify that path in the EXEC command (that stays the same) but the file won’t be executed if it’s not in the fscommand directory. You can’t even “get out” of the fscommand directory (or go deeper) using relative paths. All the EXE files have to be IN the directory.

Now for the killer restriction… You can’t have any white space characters (tabs,spaces etc) after the name of the file you’re launching. If you add anything, EXEC won’t be able to find the file. It appears to be looking for an exact match. It doesn’t even launch the file without the parameters (like it did in Flash 5), it just fails silently. While you can still EXEC applications, you can’t pass parameters to them!

The combination of these changes means that if you’ve been using tools that wrap or extend the Flash projector and you want to continue using them, you have to stick with Flash 5 for now.

This will affect commercial products like FlashJester Jugglor, FlashJester Creator and freeware tools like the The Master’s stuff at FlashTools, Les Paone’s FSTools, the PowerSWF stuff and a host of others.

A workaround using EXEC won’t happen unless Macromedia relents and opens the sandbox again. With the recent Sophos Flash “virus” and stepped up security in Flash MX this doesn’t seem likely. All of these products are going to have to find other ways to extend Flash if they’re going to make the move to Flash MX.