Flash Player 10 Security Issue Resolution

I had posted earlier concerning a strange issue with Flash Player 10 where the SWF would refuse to load if being served over a Java servlet.  We’ve been able to resolve the issue by explicitly transferring any SWF content with a “Content-Disposition” header of “inline” as suggested by Adobe.  The relevant portion of this document is replicated below:

Starting with version 10,0,2, if Flash Player sees a “Content-Disposition: attachment” header while downloading a SWF file, it will ignore the SWF file rather than play it. Note that this restriction applies only to SWF files and not to other types of content, such as images, sounds, text, or XML files, policy files, etc.

If you control the HTTP server on which the SWF file resides, determine whether you trust the SWF file to execute in the server’s domain. If so, remove the “Content-Disposition: attachment” header by changing your HTTP server’s configuration.

While our resolution did differ slightly from the one posted above.  It effectively does the same thing.

Donate to Cure Juvenile (Type-1) Diabetes

This is the first time posting something of this nature- I do so hoping that someone will stumble upon it and be moved to make a donation.

Tara and Mike of Lycia are participating in the JDRF’s Walk to Cure Diabetes on November 1st and it would be super if more people could make a donation in their name!  Lycia was a huge inspiration for myself and many others and they are directly affected by this disease.  Please help out if you are able!

[ Donate now ]

What’s Up with Flash Player 10 Final???

It seems a lot has changed from the release candidates to the final version- a lot of things people did not expect.  For instance, last minute surprise changes to the Sound API… and then the previously announced security changes that Adobe has, in fairness, warned us about since Flash Player 9.

I’ve stumbled across something that I cannot understand in one of our Java applications.  This is something that worked fine in 10.0.0.525 but is now broken in 10.0.12.36:

Simply put- a SWF (any SWF) that has loaded just fine in all previous versions of the Flash Player (including FP10 RC builds) now completely fails to load.  I’ve looked at a number of different things but cannot figure this one out!

I’ll update this as I find answers.

Big Day for Flash Player 10 (and 9)

So, we have both Flash Player 10 final (10.0.12.36) released today on top of the CS4 products shipping. We also finally see Flash Player 9 bundled with the newest Playstation 3 update (2.50).

Flash Player 10
Do I really need to write anything here? Native 3D, Custom Filter Effects, Dynamic Sound Generation, Fullscreen Keyboard Support, Hardware Acceleration, unloadAndStop() … Grab it: http://www.adobe.com/products/flashplayer/

Flash Player 9 (PS3)
Aside from being a game console, PS3 is an awesome Blu-ray player and also has web browsing capabilities.  If you’ve ever tried to load up any FP8, FP9, or FP10 content in the browser though… you’d be pretty disappointed as the only supported version of Flash Player has been FP7!  Well, with today’s update, owners can now access most FP9 content (AS3!) on their PS3s.  Awesome!

Flash Player 10 Debug
Debug versions of FP10 for developers can be found at http://www.adobe.com/support/flashplayer/downloads.html.  Super important!

Creative Suite 4
Shipping today.  I was fortunate enough to be on the beta and prerelease programs and still cannot wait to get my hands on the final bits.

HTML Links in Flex

I’ve never found the need to have HTML links in Flex behave (and look) like their true HTML counterparts, but a student recently asked how she could get HTML links defined in a Text control to behave like regular HTML links.  After digging around, I found a lot of references to this problem but the solution turned up at Flex Freaks:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

<?xml version="1.0" encoding="utf-8"?>
<mx:Application xmlns:mx="http://www.adobe.com/2006/mxml" layout="absolute">
<mx:Script>
<![CDATA[
 
import mx.core.mx_internal;
 
public function textHandler(e:Event):void
{
    var styleSheet:StyleSheet = new StyleSheet();
    styleSheet.setStyle("a:link", { textDecoration: "underline", color: "#30F" });
    e.currentTarget.mx_internal::styleSheet = styleSheet;
}
 
]]>
</mx:Script> 
 
 
<mx:Text initialize="this.textHandler(event)">
    <mx:htmlText>
    <![CDATA[
        You may <a href="">click</a> here.
    ]]>
    </mx:htmlText>
</mx:Text>
 
</mx:Application>

Apparently, this should not be used with any degree of reliability so far as future-proofing is concerned since the mx.core.mx_internal class may flux between versions of the Flex SDK.

Listed in the rumored Flex 4 improvements are support for CSS descendant selectors, ID selectors, and space-delimited style names. Something like this should really be handled via CSS so here’s hoping that this will soon be a much simpler process.

Not sure if I’ll ever need this in the future, but in the case that I do- I know it’s here for easy access.