1 Topic by josep (edited by josep 2009-05-10 23:17:00)

  • josep
  • Busy Chum
  • Offline
  • Registered: 2008-05-09
  • Posts: 139

Topic: Security Domain Violation

Hi There,

I recently updated my flash player to version 7 and now server side scripts I had set up on the chumby do not execute correctly. I now get the following error:

SecurityDomain 'http://<chumby_address>/cgi-bin/custom/my_script.sh' tried to access incompatible context 'file:///C|/<some_directory>/Test.swf

Can someone help me on with this? I had set up a crossdomain.xml on the root of the chumby server that used to work, but now it does not.

I have not proved it yet, but I also think that the new chumby player has similar issues, because one of my widgets that runs scripts that reside on the server stopped working correctly.

I created the crossdomain.xml file by changing the rcS file line:

/usr/sbin/httpd -h /www

to

/usr/sbin/httpd -h /psp/www

and placing the crossdomain.xml file in /psp/www.

The crossdomain.xml file looks like this: 

<?xml version="1.0"?>
<!-- http://127.0.0.0/crossdomain.xml -->
<cross-domain-policy>
  <allow-access-from domain="*.chumby.com" />
  <allow-access-from domain="*192.168.1.*" />
</cross-domain-policy>

Thanks for any help,
Jose

  • Duane
  • Duane
  • Blue Octy
  • Offline
  • From: San Diego, CA
  • Registered: 2006-08-24
  • Posts: 8,200

Re: Security Domain Violation

I guess the thing I'm wondering about is the "C|" in the path - I have a feeling that's your problem - FL3.1 appears to handle "|" differently.

Duane's Website

  • josep
  • Busy Chum
  • Offline
  • Registered: 2008-05-09
  • Posts: 139

Re: Security Domain Violation

Hi Duane,

Thanks for your reply.

The funny thing is that this used to work. The ONLY thing that changed are the 2 players. This is why I think I may not have had the security exactly right until the new versions of the players exposed it.

BTW, The user script uses wget to call a script on another server. Maybe that's the problem? Any ideas?


Thanks,
Jose

  • Duane
  • Duane
  • Blue Octy
  • Offline
  • From: San Diego, CA
  • Registered: 2006-08-24
  • Posts: 8,200

Re: Security Domain Violation

Ah - I just noticed that you upgraded your desktop player to Flash 7 - yes, that definitely affects things.  Flash 7 has a much, much tighter security policy than previous versions of Flash.  You can try republishing your movie as Flash 6 - that may lower the security to more lenient levels.

Flash 8 through 10 tighten the policies even further. The security policy rules are pretty well documented on Adobe's site.

Duane's Website

  • josep
  • Busy Chum
  • Offline
  • Registered: 2008-05-09
  • Posts: 139

Re: Security Domain Violation

Hi Duane,

I did try to publish for 6 without any luck. So are crossdomain.xml files not enough?

Thanks,
Jose

  • Duane
  • Duane
  • Blue Octy
  • Offline
  • From: San Diego, CA
  • Registered: 2006-08-24
  • Posts: 8,200

Re: Security Domain Violation

They should be - however, I'd try replacing the line:

  <allow-access-from domain="*192.168.1.*" />


with

  <allow-access-from domain="192.168.1.*" />

Note the removal of the leading "*".

On the chumby itself, you can ssh into the device and issue the "stop_control_panel; start_control_panel" and see a log of what's going on - you should see the fetch for the crossdomain file and see what it's complaining about.

Duane's Website

  • josep
  • Busy Chum
  • Offline
  • Registered: 2008-05-09
  • Posts: 139

Re: Security Domain Violation

Hi Duane,

As always, thanks for your help. I'll give it a try tonight. 

The one thing that bothers me is that the chumby that was running directly from chumby.com died also. My crossdomain file seems to be correct for anything from chumby, no? Maybe the FL update got me as well as the update to player 7?

Thanks,
Jose

  • Duane
  • Duane
  • Blue Octy
  • Offline
  • From: San Diego, CA
  • Registered: 2006-08-24
  • Posts: 8,200

Re: Security Domain Violation

It's possible - it's hard to know without taking a look at the actual code.

Duane's Website

9 Reply by josep (edited by josep 2009-05-11 12:11:37)

  • josep
  • Busy Chum
  • Offline
  • Registered: 2008-05-09
  • Posts: 139

Re: Security Domain Violation

Hi Duane,

Which code do you want to see? The server side script?

I guess generally, how does the player at the client know that the server is accessing something that does not reside at the server? It seems like the server needs to play nice and tell the client that it is doing that. For instance, here is my environment:

I prototype (the client) on 192.168.1.2, so the test.swf file sits there. The chumby is assigned the ip 192.168.1.6. I load a movie from the chumby server. The server executes a script that does a wget to get stuff from 192.168.1.3. If I return a jpeg, the client is happy, but if I try to do more complex communication the client gives me a security violation.

I'm a little confused as to why the jpeg return works anyway. Technically, to get the jpeg, 192.168.1.6 had to go to 192.168.1.3.

Can you clarify this a little for me? I am sorry I sound like such a newbie, but I have read the documentation a few times and something doesn't seem to be clicking. 

The server side script is literally just a wget to get around the authentication that is needed at 192.168.1.3.   


Thanks,
Jose

  • From: Melbourne, Australia
  • Registered: 2009-01-15
  • Posts: 165

Re: Security Domain Violation

josep wrote:

Hi There,

I recently updated my flash player to version 7 and now server side scripts I had set up on the chumby do not execute correctly. I now get the following error:

SecurityDomain 'http://<chumby_address>/cgi-bin/custom/my_script.sh' tried to access incompatible context 'file:///C|/<some_directory>/Test.swf

Can someone help me on with this? I had set up a crossdomain.xml on the root of the chumby server that used to work, but now it does not.

I have not proved it yet, but I also think that the new chumby player has similar issues, because one of my widgets that runs scripts that reside on the server stopped working correctly.

I created the crossdomain.xml file by changing the rcS file line:

/usr/sbin/httpd -h /www

to

/usr/sbin/httpd -h /psp/www

and placing the crossdomain.xml file in /psp/www.

The crossdomain.xml file looks like this: 

<?xml version="1.0"?>
<!-- http://127.0.0.0/crossdomain.xml -->
<cross-domain-policy>
  <allow-access-from domain="*.chumby.com" />
  <allow-access-from domain="*192.168.1.*" />
</cross-domain-policy>

Thanks for any help,
Jose

Hi,
   as a general note I have found that crossdomain issues usually give weird errors e.g. if your crossdoain file has an error flash looks for another one in usual places (root etc). Then if this is not there you get an error based on this file not the one you specified.

Not sure if this will help but I do it as follows.

The script that delivers data also delivers policy based on the argument provided.

In SWF says

    System.security.loadPolicyFile("http://"+ipaddress+"/cgi-bin/custom/ipusage.pl?POLICY");

In my script (perl) in  /www/cgi-bin/custom/ipusage.pl it says

$request = uc($ENV{'QUERY_STRING'});

if ($request eq "POLICY") # URL requests policy
  {
    # send the crossdomain policy file

    print "Content-type:text\/xml\r\n\r\n";
    print "<\?xml version=\"1.0\"\?>\r\n\r\n";
    print "<\!-- my crossdomain file -->\n";
    print "<cross-domain-policy>\n";
    print "  <allow-access-from domain=\"\*.chumby.com\" \/>\n";
    print "<\/cross-domain-policy>\n";

  }

hope it helps.

cheers

Nigel

  • josep
  • Busy Chum
  • Offline
  • Registered: 2008-05-09
  • Posts: 139

Re: Security Domain Violation

Hi NigelS,

Thanks for your post. Do I have to specifically load the policy file? This all used to work before I updated the players....Arg.

Thanks,
Jose

12 Reply by josep (edited by josep 2009-05-11 23:47:22)

  • josep
  • Busy Chum
  • Offline
  • Registered: 2008-05-09
  • Posts: 139

Re: Security Domain Violation

I guess I am totally stumped on this one... It's almost like the crossdomain.xml file is being ignored. Thanks for all the help.

EDIT: I forgot to mention that I got a new router a few days ago. Maybe something is turned off at the router? Some port?

Regards,
Jose

  • From: Melbourne, Australia
  • Registered: 2009-01-15
  • Posts: 165

Re: Security Domain Violation

josep wrote:

Hi NigelS,

Thanks for your post. Do I have to specifically load the policy file? This all used to work before I updated the players....Arg.

Thanks,
Jose

Jose,
      Yes you do need to point at it - this is in the line

System.security.loadPolicyFile("http://"+ipaddress+"/cgi-bin/custom/ipusage.pl?POLICY");


cheers

Nigel

14 Reply by josep (edited by josep 2009-05-13 07:25:55)

  • josep
  • Busy Chum
  • Offline
  • Registered: 2008-05-09
  • Posts: 139

Re: Security Domain Violation

Hi All,

Thanks for all your help. My problem actually had nothing to do with crossdomain policy files OR security. As it turns out, I inadvertently added an extra empty frame in one of my components that get instantiated on the stage, which caused really crazy behavior. Not sure why the player thought this was a Security Sandbox violation...

For what it's worth, I am learning a lot about flash security. smile

Regards,
Jose

  • josep
  • Busy Chum
  • Offline
  • Registered: 2008-05-09
  • Posts: 139

Re: Security Domain Violation

Hi All,

I decided to bump this because as it turns out my flash programming error was not the cause of the the server side scripts not running. I had a bug that was creating the strange Domain Violation errors, but once I fixed that, the server side scripts still do not run. I am convinced that there is something funny about how the crossdomain files are being recognized since the 1.7 firmware release, but I can't figure out what.

I ran my widget locally and it was able to run the server side scripts, but when I run from chumby.com, the scripts do not run. Before the 1.7 firware release, my widgets were able to run the scripts. I ran the control panel manually and am able to see the TRACE commands I  wrote into the code right before it calls the server side script, but no error explaining why the scripts do not run.

I have the crossdomain.xml file on the top level of the server as instructed. I even loaded the policy file in the way that NigelS suggested, but no dice. Any ideas? Is there a new security thingy I am supposed to be doing that I missed? Is the new player not recognizing my crossdomain.xml file?

Thanks for any help,
Jose