Security Sandbox Violation by a Bitmap in a Flex AIR desktop application?

Question

*** Security Sandbox Violation ***
SecurityDomain 'file:///Users/Bluebird/Desktop/Demo/Project/Level_01
/Background.png' tried to access incompatible context 'app:/project.swf'

I understand that these "security" alerts are difficult to track down and even more difficult with scant information but I thought I would ask.

I have a large Flex/AIR desktop project where the user can select images off their local drive and collage them. There are also some swfs provided which they can use as "stamps". I am getting the error below when stamps are added to the app and clicked – the stamps have eventListeners attached – but the error does not reference the stamp (swf) but instead it references the background image.

The background image is a Spark Image defined in MXML:

<s:Image id="backgroundImage" x="{renderX}" y="{renderY}" 
         width="{renderWidth}" height="{renderHeight}" 
         smooth="true" smoothingQuality="high" scaleMode="stretch" 
         complete="backgroundImage_completeHandler(event)" />

The complete function does nothing important. The source property for the image is defined once the user has selected a local image:

      backgroundImage.source = userFile.url

I don't see anywhere to provide a loaderContextfor the Image component (one solution usually suggested for "security" errors). Also, the backgroundImage component has no eventListeners – so I am completely baffled why it is throwing an error.

I've set the Flex compiler option to -use-network = false since this is just a desktop app and that is another commonly suggested "security" fix. I am also loading the "stamp" swfs through the trick of loading them as a byteArray first – another commonly suggested "security" fix.

Can someone help me hate Flash a little less?

Answer 1

For a quick check and probably fix, Instead the following line:-

backgroundImage.source = userFile.url

Trying giving it the relative path to the image file instead full absolute path. like:

backgroundImage.source = "../images/bg.png"; 

Also, I assume you have already provided Security.allowDomain("*") in your stamp swfs.

Answer 2

First of all, per the Loader documentation, if you include the swf in the installed application content there won't be any security restrictions when loading it.

Otherwise, the Image component extends SWFLoader which does have a loaderContext property. Try passing in the current domain:

new LoaderContext(ApplicationDomain.currentDomain, SecurityDomain.currentDomain)