MACROMEDIA FLASH MEDIA SERVER 2-MANAGING FLASH MEDIA..., Руководство пользователя

Страница: 220 / 238

220 Flash Media Server Security
Secure script loading
The Flash Media Server script security model enables one to limit the exposure to potentially
malicious or buggy third-party code that may be included on the server side. An example
would be an extensible application where users could download third-party plug-ins or
components, then load or evaluate them in the application. If you are concerned that such
plug-ins or components may compromise the system, you can apply the script security model
to restrict them. The script security model is not designed to detect or prevent error
conditions such as an infinite loop in third-party code, but it is useful for preventing or
limiting certain potentially dangerous functionality such as the ability to make arbitrary
connections, and read/write file objects.
Script security is probably not applicable for most applications, but it can be very valuable to
anyone building dynamically extensible applications—the kind that loads and evaluates code
from external sources.
When an application is started, it first looks for and loads the file secure.asc. During this
period of time, it makes the APIs
protectObject()
and
getGlobals()
available. These may
be used to manipulate global functions, classes and objects in a way that is not possible during
normal application execution. Once Flash Media Server is done loading
secure.asc
, it
makes these APIs unavailable. It then proceeds to load
main.asc
and other scripts in the
normal manner.
For example, if you wanted to implement an ID generator that must generate an ever
increasing numbers for IDs, then you would add a function like the following in your
main.asc
script.
Example
idGen = {};
idGen._nextID = 0;
idGen.nextID = function() { return this.+; }
This example suffices for generating IDs. However any part of the script can easily redefine
the
nextID()
function or directly modify the
_nextID
value. There was no way to prevent
redefinition in the previous versions of Flash Media Server. With the script security model,
however, you simply add the code for the generator into
secure.asc
.
// Begin secure.asc
trace( "loading secure.asc" ) ;
var global = getGlobal(); // grab the global object
var idgen = {};
idgen._nextID = 0;
idgen.nextID = function() { return this.+; }
// Create a protected object out of idgen and make it