AIR security flaw

Posted on July 20, 2009


Opening a new browser out side any AIR application will dispose the url variables on the browser.

Although it’s not 100% logical to put this claim on AIR applications because that is meant for desktop application and have least relation with external browsers, it’s an issue that you may get some time while launching any external browser( ‘external’ means not inside AIR application itself).  This problem creates security flaws when you are opening a browser against some authenticated data or session. Even if use ‘post’ method to send the urlvariables, they wont be hidden on the browser.

Here is one example where you can find such trouble.

  1. <?xml version="1.0" encoding="utf-8"?>
  2. <mx:WindowedApplication xmlns:mx="http://www.adobe.com/2006/mxml" layout="absolute">
  3.         <mx:Button x="399" y="305" label="Button" click="getUI()" />
  4.        
  5.         <mx:Script>
  6.                 <![CDATA[
  7.                         private function getUI():void{
  8.                                 var re:URLRequest=new URLRequest("http://localhost/url/check.php");
  9.                                 re.method=flash.net.URLRequestMethod.POST;
  10.                                
  11.                                 var urlv:URLVariables=new URLVariables;
  12.                                 urlv.desc=5;
  13.                                 re.data=urlv;
  14.                                 navigateToURL(re,"_self");
  15.                         }
  16.                 ]]>
  17.         </mx:Script>
  18.        
  19. </mx:WindowedApplication>

When you run this example it will open a browser and will show the variable name and value where as if you write the same sort of code in for web application it would not show the ‘desc=5′ in the browser.
A sample piece of same code is given below which is implemented for a mouse click event on button.

  1. abc_mc.addEventListener(MouseEvent.CLICK, ola);
  2.  
  3. function ola(e:MouseEvent):void{
  4.         var re:URLRequest=new URLRequest("http://localhost/url/check.php");
  5.         re.method=flash.net.URLRequestMethod.POST;
  6.        
  7.         var urlv:URLVariables=new URLVariables;
  8.         urlv.desc=5;
  9.         re.data=urlv;
  10.         navigateToURL(re,"_blank");
  11. }

The php code used in the test is as follows:

  1. <?
  2. $test=$_REQUEST[‘desc’];
  3. echo $test;
  4. ?>
  5.  

So be sure you should never pass any data while opening some browser.


Posted Under AIR, AS3 »


Comments

Leave a Reply