16 Replies Latest reply: Jun 21, 2012 11:16 PM by Flex harUI RSS

    UrlLoader throwing security sandbox exception in Firefox

    Shubhra Bhushan

      Our app used to work fine on all browsers (IE, chrome, firefox is what we deliver it into) but for more than a month now it has stopped working on firefox selectively. By selectively I mean that it works on firefox on some machines like - if a user accesses it from home network it works fine, and for some users it works on office networks as well so we cant really generalize. I debugged the code within office network and these are the first 3 lines of trace that I get on console.

       

      [SWF] C:\VMC_Development_Release\New_UI\bin-debug\xyz.swf - 4,166,632 bytes after decompression

      *** Security Sandbox Violation ***

      SecurityDomain 'null' tried to access incompatible context 'file:///C:/VMC_Development_Release/New_UI/bin-debug/xyz.swf'

       

      Above error comes when first xml is loaded by the app. The error is thrown on the line in bold.

       

      public function loadAppXml():void

                  {

                      var urlLoad:URLLoader=new URLLoader();

                      urlLoad.load(new URLRequest("xmls/emailName.xml"));

                      urlLoad.addEventListener(Event.COMPLETE, onXmlLoaded);

                  }

       

      public function onXmlLoaded(e:Event):void

                  {

                      var xm:XML=XML(e.currentTarget.data);

                  }

       

      We have not been using crossdomain.xml at all. and i dont think that is the cause of the problem as our app works on mozilla on many machines anyways.

       

      Can anybody suggest a solution?

      Any help is highly appreciated.

        • 2. Re: UrlLoader throwing security sandbox exception in Firefox
          Flex harUI Adobe Employee

          You are loading SWFs off the local file system and the SWF is loading a local file.  Depending on how the SWF was built, it might require trust files in order to work.  See the Flash Player Security Whitepapers.

          • 3. Re: UrlLoader throwing security sandbox exception in Firefox
            Shubhra Bhushan Community Member

            Flex harUI, I did check them. But that did not help. While delving more I observed that when I connect to home network I turn off the proxy in IE LAN settings (Tools -> Internet Options -> Connections -> LAN Settings). I mean in that pop up I leave only "Automatically Detect Settings" checked. Rest all are unchecked. And firefox works fine on my machine after that. As soon as I enter office network and turn on proxy settings I see the same trouble. What do I do? Neither myself nor our clients can turn off proxy for this app.

            Please help.

            • 4. Re: UrlLoader throwing security sandbox exception in Firefox
              Flex harUI Adobe Employee

              Try using a network monitor to see if the SWF is trying to access the network.  You have to set use-network properly or use trust files depending on what you want to do.

              • 5. Re: UrlLoader throwing security sandbox exception in Firefox
                Shubhra Bhushan Community Member

                Flex harUI, following are my observations:

                1. This problem is now coming on IE 9 and chrome as well though on selective machines only.
                2. I put use-network=true in compiler arguments and even then I got the same problem.
                3. I also added my dev folder paths in C:\Users\<username>\AppData\Roaming\Macromedia\Flash Player\#Security\FlashPlayerTrust\dev.trust.cfg but that too did not help.
                4. I used firebug and I found that
                  1. swf loads successfully all the time without fail.
                  2. after swf we load around 10 xmls in our app (and then images) and they stop loading at any arbitrary xml. For ex - sometimes the 1st xml is not loaded  and sometimes the 4th is not loaded and so on... but we never reach the image loading stage. we are very much stuck loading the xmls.
                5. Also, going beyond dev environment, when we deploy the app on prod server then all these xmls are placed in the server folder (all the paths of these xmls are given relatively in the code as shown in the first post of this discussion) so technically Flash Player is not loading them from dev environment. FP is loading the swf from prod server and the xmls too frm prod server from the same location where swf is placed.

                 

                Flex harUI please advise what do I do now? Is there some change in FP 11 security?

                • 6. Re: UrlLoader throwing security sandbox exception in Firefox
                  Flex harUI Adobe Employee

                  I assume your goal is to deploy this on a production server.  If so, then I would not run it from file:// and instead do all of your testing via a server.  You can set up a localhost server on your development machine if needed.  Then, make sure that flash.system.Security.sandboxType is “remote” by adding some small label to the app.  Once you are set up in such an environment, see if you still have the problem and post the exact text of the errors including stack traces.  The one in your original post probably came from some other sandbox type.

                  • 7. Re: UrlLoader throwing security sandbox exception in Firefox
                    Shubhra Bhushan Community Member

                    Flex harUI, How do I set the Security.sandBoxType property to "remote"? It is read-only and when I traced it for my app it is set to "localTrusted". I googled this one but could not find any lead to change the type!

                    • 8. Re: UrlLoader throwing security sandbox exception in Firefox
                      Flex harUI Adobe Employee

                      It can only be set by how you run your app.  You must run it from http:// or https:// and not fiile:// or some local path.  That’s why I said you should set up a server for testing.  LocalTrusted has different security rules and some things won’t work or won’t work when you finally deploy to “remote”.  So get set up properly in development and you will have fewer surprises in production.

                      • 9. Re: UrlLoader throwing security sandbox exception in Firefox
                        Shubhra Bhushan Community Member

                        Thanks Flex harUI.

                        I set up the test server (http://) and tested the app. I used these in mm.cfg to get the traces:

                         

                        ErrorReportingEnable=1

                        TraceOutputFileEnable=1

                        MaxWarnings=100

                         

                        and following are the traces that I got in flashlog.txt:

                         

                        Security.sandboxType: remote

                        Error #2044: Unhandled ioError:. text=Error #2032: Stream Error. URL: xmls/followUSImageXmlPath.xml

                            at com.a1.sap.views.sprint4.user::RegisterForm/loadFollowUSImageFun()

                            at com.a1.sap.views.sprint4.user::RegisterForm/init()

                            at com.a1.sap.views.sprint4.user::RegisterForm/___RegisterForm_VBox1_creationComplete()

                            at flash.events::EventDispatcher/dispatchEventFunction()

                            at flash.events::EventDispatcher/dispatchEvent()

                            at mx.core::UIComponent/dispatchEvent()

                            at mx.core::UIComponent/set initialized()

                            at mx.managers::LayoutManager/doPhasedInstantiation()

                            at Function/http://adobe.com/AS3/2006/builtin::apply()

                            at mx.core::UIComponent/callLaterDispatcher2()

                            at mx.core::UIComponent/callLaterDispatcher()

                        Error #2044: Unhandled ioError:. text=Error #2032: Stream Error. URL: xmls/LocalesList.xml

                            at com.a1.sap.views.sprint4.user::RegisterForm/loadLocaleFun()

                            at com.a1.sap.views.sprint4.user::RegisterForm/init()

                            at com.a1.sap.views.sprint4.user::RegisterForm/___RegisterForm_VBox1_creationComplete()

                            at flash.events::EventDispatcher/dispatchEventFunction()

                            at flash.events::EventDispatcher/dispatchEvent()

                            at mx.core::UIComponent/dispatchEvent()

                            at mx.core::UIComponent/set initialized()

                            at mx.managers::LayoutManager/doPhasedInstantiation()

                            at Function/http://adobe.com/AS3/2006/builtin::apply()

                            at mx.core::UIComponent/callLaterDispatcher2()

                            at mx.core::UIComponent/callLaterDispatcher()

                         

                        Please recommend how do I do away with these errors so that xml files are successfully loaded on the server and app is run successfully.

                        • 10. Re: UrlLoader throwing security sandbox exception in Firefox
                          Flex harUI Adobe Employee

                          Notice that you have not gotten a security error in this configuration.  See this article: http://www.judahfrangipane.com/blog/2007/02/15/error-2032-stream-error/

                          • 11. Re: UrlLoader throwing security sandbox exception in Firefox
                            Shubhra Bhushan Community Member

                            Thanks again Flex harUI. I really appreciate your inputs.

                             

                            I checked that link and this is the analysis:

                             

                            1. We connect using AMFChannel like this var channelEndpoint:AMFChannel=new AMFChannel("my-amf", "/Benchmarking/Gateway.aspx");
                            2. As you can see in the code I had posted in my first post the path I'm giving for xmls is relative. I gave absolute path also but then too I got the same error.
                            3. I then kept this crossdomain.xml on the server:

                               <?xml version="1.0" encoding="UTF-8" ?>

                            - <cross-domain-policy>

                              <allow-access-from domain="*" />

                              </cross-domain-policy>

                             

                            And the error remained the same.

                             

                            4. I opened both xmls in Mozilla using their absolute urls that i was giving in code and they opnened perfectly.

                             

                            What should I conclude now? Please note that app works smooth on IE, chrome and on 50% machines with Firefox.

                            • 12. Re: UrlLoader throwing security sandbox exception in Firefox
                              Flex harUI Adobe Employee

                              It would be odd to use AMF to load XML files.  Why aren’t you using URLLoader or HTTPService?

                              You are not getting a security error so crossdomain.xml probably isn’t a factor.

                               

                              As you can tell from the article and by searching the internet, this problem happens to a lot of people.  Judah’s article has helped a lot of folks, but some seem to have found other solutions.  I am not an expert in resolving #2032 errors.  You will have to research it on your own.  The first thing I would do, however, is use a network monitor.

                              • 13. Re: UrlLoader throwing security sandbox exception in Firefox
                                Shubhra Bhushan Community Member

                                Oh probably I did not frame it properly :-( We are using AMF to make the connection and then URLLoader to load the xml like this:

                                public function loadAppXml():void

                                            {

                                                var urlLoad:URLLoader=new URLLoader();

                                                urlLoad.load(new URLRequest("xmls/emailName.xml"));

                                                urlLoad.addEventListener(Event.COMPLETE, onXmlLoaded);

                                            }

                                I have been using a network monitor for this problem for about 2 days now. This is a screenshot of firebug. I have hidden parts of swf name, domain and Remote IP for confidentiality reasons.

                                 

                                Firebug_traces.png

                                 

                                Please share your ideas on it. All ideas are helpful....

                                • 15. Re: UrlLoader throwing security sandbox exception in Firefox
                                  Shubhra Bhushan Community Member

                                  Flex harUI, I solved the problem! And its solution is neither of which we discussed here :-) This is the synopsis.......

                                   

                                  In our organization's corporate network we use automatic configuration script. That script was selectively allowing mozilla's (and in some cases Chrome and IE as well) access to our app. Why was it doing that we have no idea. But when I sat yesterday evening thinking about all those ideas we tried solving this I realized that the response of very first xml loading never comes which means that something stops it. As keeping a crossdomain.xml had not worked as well so I checked the proxy settings in my Laptop and unchecked Internet options -> Connections -> LAN Settings -> Use automatic configuration script in IE and it started working fine. Then i did the same on all machines I knew where app was not working mysteriously and this solution worked everywhere :-) I had a chat with out IT team and they do not have much problem in unchecking this coz it is used for accessing internal portal's redirect.

                                   

                                  Thanks a lot Flex harUI. You helped a lot :-)

                                  • 16. Re: UrlLoader throwing security sandbox exception in Firefox
                                    Flex harUI Adobe Employee

                                    Excellent.  Please add your story to the link I provided so others can use it for reference.