This is a page containing very basic tests of cross-domain loaded SWFs scripting each other. The ability to safely load and permit cross-domain SWF scripting is a feature that will be required to support ads and other types of content that utilize a parent loading SWF. http://people.mozilla.org/~mwobensmith/flash/sandbox/ Currently, Shumway does not sandbox SWFs by domain and therefore has no permission mechanism to test. Examples here are AVM1 and AVM2, and simply check to see if they can read a variable across a domain boundary. Not tested: - Anything other than allowDomain("*") - Cross-protocol scripting - Redirects - Other types of data access

Affects dynamically loaded ads.

Matt, could you perhaps put a crossdomain.xml file on both domains allowing access to each other? I know that it's not required for your test case in the Flash plugin, but it would make testing easier for us as long as we have the "only load SWFs from domains that allow data loading" restriction in place. We have SecurityDomains implemented, and I'd like to test how well they work.

Hi Till - I'm happy to do so. Obviously there are many ways to configure policy files. Create the policy files you want to test with and get them to me (here in the bug or send to me directly) and I'll stage them ASAP. Make sure to specify if you want them in a given directory or in the root - or both. Thanks.

Great, thanks! We only want to test the SecurityDomain functionality here, so the crossdomain.xml file can just allow everything: it doesn't matter much. Either "*" or the other SWF's domain would be great.

OK, will do. Is this a root policy file? Or in the same directory as the SWF?

(In reply to Matt Wobensmith from comment #7) > OK, will do. Is this a root policy file? Or in the same directory as the SWF? A root file would be great. I'm not sure we already support the same-directory version.

I've put a permissive policy file at: http://mattdev.orgfree.com/flash/sandbox/crossdomain.xml So, SWFs that load from the parent domain of people.mozilla.org should be working. However, I can't put root policy files on people.mozilla.org because I don't control that domain, so tests here where the child wants to access the parent won't work. If this is enough to validate your work on SecurityDomains, great. I suspect, though, that for more testing you'll need to emulate multi-domain data access, as well as HTTPS and all of the directives that can be used in a policy file. Sadly that is more than I can provide at this time, but would be happy to work with you on that in the future.

Oops, correction: I've put a permissive policy file at: http://mattdev.orgfree.com/crossdomain.xml And not in the directory mentioned above. Otherwise, all other comments are the same.