[flexcoders] Re: Fortify Scan on my Application

From: flexcoders@yahoogro ups.com [mailto:flexcoders@yahoogro ups.com] On

Behalf Of Parkash
Sent: Monday, March 30, 2009 2:43 AM

To: flexcoders@yahoogro ups.com
Subject: [flexcoders] Fortify Scan on my Application.


Hello All,





I ran fortify scan on my application and getting the three hot issues on
history.js and historyFrame. html.


How can I eliminate the problems from these files?




Do I really need these files can I delete these files can any one tell me

the purpose of these files.



The hot issues are listed below.




Issue # 1:






ABSTRACT:



The method addHistoryEntry( ) in history.js sends unvalidated data to a web

browser on line 207, which can result in the browser executing malicious

code.




EXPLANATION:


Cross-site scripting (XSS) vulnerabilities occur when:



1. Data enters a web application through an untrusted source, most

frequently a web request or database.



2. The data is included in dynamic content that is sent to a web user

without being validated for malicious code.



The malicious content sent to the web browser often takes the form of a

segment of JavaScript, but may also include HTML, Flash or any other type of

code that the browser may execute. The variety of attacks based on XSS is

almost limitless, but they commonly include transmitting private data like

cookies or other session information to the attacker, redirecting the victim

to web content controlled by the attacker, or performing other malicious

operations on the user's machine under the guise of the vulnerable site.





Issue # 2:



ABSTRACT:



The method checkForUrlChange( ) in history.js sends unvalidated data to a web

browser on line 283, which can result in the browser executing malicious

code.



EXPLANATION:



Cross-site scripting (XSS) vulnerabilities occur when:


1. Data enters a web application through an untrusted source, most
frequently a web request or database.



2. The data is included in dynamic content that is sent to a web user
without being validated for malicious code.



The malicious content sent to the web browser often takes the form of a
segment of JavaScript, but may also include HTML, Flash or any other type of
code that the browser may execute. The variety of attacks based on XSS is
almost limitless, but they commonly include transmitting private data like
cookies or other session information to the attacker, redirecting the victim
to web content controlled by the attacker, or performing other malicious
operations on the user's machine under the guise of the vulnerable site.


Issue # 3:



ABSTRACT:



The method lambda() in history.js sends unvalidated data to a web browser on
line 509, which can result in the browser executing malicious code.


EXPLANATION:

Cross-site scripting (XSS) vulnerabilities occur when:

1. Data enters a web application through an untrusted source, most
frequently a web request or database.

2. The data is included in dynamic content that is sent to a web user
without being validated for malicious code.
The malicious content sent to the web browser often takes the form of a
segment of JavaScript, but may also include HTML, Flash or any other type of
code that the browser may execute. The variety of attacks based on XSS is
almost limitless, but they commonly include transmitting private data like
cookies or other session information to the attacker, redirecting the victim
to web content controlled by the attacker, or performing other malicious
operations on the user's machine under the guise of the vulnerable site.


Issue # 4:

ABSTRACT:

The method ~file_function( ) in historyFrame. html sends unvalidated data to a
web browser on line 25, which can result in the browser executing malicious
code.


EXPLANATION:
Cross-site scripting (XSS) vulnerabilities occur when:

1. Data enters a web application through an untrusted source, most
frequently a web request or database.

2. The data is included in dynamic content that is sent to a web user
without being validated for malicious code.


In this case the data is sent at write() in historyFrame. html at line 25.


The malicious content sent to the web browser often takes the form of a
segment of JavaScript, but may also include HTML, Flash or any other type of
code that the browser may execute. The variety of attacks based on XSS is
almost limitless, but they commonly include transmitting private data like
cookies or other session information to the attacker, redirecting the victim
to web content controlled by the attacker, or performing other malicious
operations on the user's machine under the guise of the vulnerable site.


Thanks



Parkash

[flexcoders] Re: Ruben's FlexBook component question

On Tue, Mar 24, 2009 at 10:48 PM, Igor Costa <igorcosta@gmail. com> wrote:

Hi there Guy's


So, hard to ask something before hard searching across web. My question is simple, how many of you guys there tried and extended the Ruben's FlexBook Component since the releases source code?


I found a guy who added a couple of public methods but no one that made the size of book re sizable when the screen gets bigger or less.


I'm fighing agaist this little bug book component. And added some exra methods, doesnt any guys there who want to change your experience with this component with me?


Regards


--

------------ --------- -------

Igor Costa

www.igorcosta. com

www.igorcosta. org

[flexcoders] Re: Portable way to get hostname in AIR app?

--- In flexcoders@yahoogro ups.com, "Gregor Kiddie" <gkiddie@... wrote:

We ended up having the shortcut have the url we were aiming at as a parameter.

Other solutions include always kicking off the AIR app from a web page (and passing the url as a parameter)

InvokeEvent is what you'll be interested for these things, along with the Flex API with dealing with AIR files.


Gk.



Gregor Kiddie

Senior Developer

INPS

[flexcoders] Re: FlexMDI controlling Tab navigation

--- In flexcoders@yahoogro ups.com, "raja_s_patil" <kpr.rspatil@ ...> wrote:

hello,

I am in processing of evaluating Flex to be used for migrating our Desktop Delphi database applications to WEB. Till Date we found very positive features and have opinion that Flex is suiting our many requirements. Our existing application is composed of many forms and some them remain open simultaneously in a typical practical use of application. We came across FlexMDI and found that this satisfies this requirement but when we press tab key to navigate between controls in a form then it passes through all controls in that window and then it goes to captions buttons and then goes to next window.

We would like to restrict this tab navigation to same window and may be <CTRL-TAB to switch between different windows. How can we achieve this ? U can think of a typical desktop window behaviour simulation in flex.

Thanks and Best Regards

[flexcoders] Re: Context Menu Bug in FlashPlayer ?

The code below causes both IE and Firefox to crash (haven't tried others). The problem seems to occure when removing an item from a custom context menu. It doesn't even debug, just crashes the browser.

If I add this one line:

menu.customItems. pop();

then the browser crashes. If I remove it, if functions as expected.

Please help.

Sample code below:




import mx.controls. Alert;
[Bindable] public var menu:ContextMenu;
[Bindable] public var blankMenu:ContextMe nu;

public function mouseOvr(event: MouseEvent) :void {
menu = new ContextMenu;
var addPop:ContextMenuI tem = new ContextMenuItem( "Do Something");
addPop.addEventList ener(ContextMenu Event.MENU_ ITEM_SELECT, newPop);
menu.customItems. push(addPop) ;
myButton.contextMen u = menu;
}
public function newPop (event:ContextMenuE vent):void {
Alert.show(" Hi");
}
public function mouseOt(event: MouseEvent) :void {
myButton.contextMen u = blankMenu;
menu.customItems. pop();
}
]]>

[flexcoders] Re: Flex on mobile devices

Thanks, Alex. That helps. I've heard that Flash 10 should be available for most smart phones by next year (http://reviews. cnet.com/ 8301-13970_ 7-10164745- 78.html). However, technical difficulties are keeping the iPhone from getting Flash-enabled.



- Alex C



--- In flexcoders@yahoogro ups.com, Alex Harui <aharui@...> wrote:

>

> Roughly 0 handle Flex apps. Work is in progress for a Flash Player that can handle ActionScript 3 and work on a mobile device.

>

> There's supposedly a billion mobile devices that can run Flash apps designed for mobile.

>

> Adobe has every intention to get Flex apps running on mobile devices going forward. Smart companies will be planning for Flex on mobile in their futures even though numbers are zero now.

>

> Alex Harui

> Flex SDK Developer

> Adobe Systems Inc.<http://www.adobe. com/>

> Blog: http://blogs. adobe.com/ aharui

>

> From: flexcoders@yahoogro ups.com [mailto:flexcoders@yahoogro ups.com] On Behalf Of oneworld95

> Sent: Tuesday, March 31, 2009 9:29 AM

> To: flexcoders@yahoogro ups.com

> Subject: [flexcoders] Flex on mobile devices

>

>

> Roughly, what percentage of mobile devices today can handle Flex (Flash) apps? I need some hard numbers to convince my boss to use Flex for more projects. Thanks.

>

> - Alex C

>

[flexcoders] Flex Debug Problem

I have imported an AIR project to Flex Builder 3.2.0, but I get this error:



Process terminated without establishing connection to debugger.



Command:



"/Applications/ Adobe Flex Builder 3/sdks/3.2.0/ bin/adl" -runtime "/Applications/ Adobe Flex Builder 3/sdks/3.2.0/ runtimes/ air/mac" "/Users/mac_ video/Documents/ Flex Builder 3/PSM Flash2/bin-debug/ psmflash- app.xml" "/Users/mac_ video/Documents/ Flex Builder 3/PSM Flash2/bin-debug"



Output from command:



initial content not found



I have changed the 2nd line of project specs with

<application xmlns="http://ns.adobe. com/air/applicat ion/1.5" >

but it doesn't work...



Anyone have an idea about that? Thank you very much, it's very important for me and for my work.