MACROMEDIA FLASH MEDIA SERVER 2-MANAGING FLASH MEDIA..., Manual

Page: 221 / 238

JavaScript security 221
// available globally as idGen.
global.idGen = protectObject( idgen );
// Make idGen non-enumerable, read-only and permanent
setAttributes( global, "idGen", false, true, true );
When normal script loading begins
idGen
will be available as a global object, that cannot be
compromised by any script loaded directly or indirectly from
main.asc
.
Example
//main.asc
trace( "Loading main.asc" );
trace( "idGen = " + idGen );
idGen = 50;
trace( "idGen = " + idGen );
Here’s the output for main.asc:
Example
Loading secure.asc
Loading main.asc
idGen = [object Redirector]
idGen = [object Redirector]
If you are using Linux, remember that
secure.asc
is case sensitive.
Protecting objects
A new global function in Flash Media Server lets application developers protect user-defined
objects behind C-wrapper objects. The function
protObj = protectObject(userObj);
takes an object and returns the wrapper object. Any user-defined object that has been
protected with this
proObj
function becomes a wrapper object whose methods may be
considered as system calls since they cannot be compromised.
The wrapper object returned by this function fulfills all invocations to the underlying user
object but blocks access to the member data. As a result, one cannot enumerate or modify
members directly. Once an object has been protected with this function, you need to make
sure that it is no longer accessible in global variables or as a member of an accessible object.
The wrapper object keeps a reference to the underlying user object to ensure that it remains
valid during the lifetime of the wrapper. The wrapper itself follows the normal reference rules
and exists as long as an application refers to it.
Protected objects can be used to implement any security model, such as system calls, privilege
rings, and ACLs (Access Control Lists).