Question

Since i’m having some issues with a sandbox here, i’m looking for a little workaround that should work to proxify the assets loaded by a remote swf.

Currently after loading a remote swf, and trying to draw a bitmap i get the following error:

Security sandbox violation: BitmapData.draw: http://urlhere cannot access http://remotehost/clothes/bg/bg_10438411_bg.swf. This may be worked around by calling Security.allowDomain.

Now, i want to see if it’s possible to catch & change the swf’s that the remote swf loads. So i can load them through a php file and then into the swf instead. Basically editing the URL that it loads the swf from.. Any suggestions?

Answer 1

It looks like you’re trying to draw a snapshot of a loaded swf using BitmapData.draw().
You will either need a crossdomain.xml on the server holding the swf you’re loading, either proxy it through a server side script.

If you have a crossdomain.xml, you can use pass a LoaderContext as the second parameter of Loader’s load() method, explicitly requesting crossdomain checking.
If the security requirements are not met, a SecurityErrorEvent will be dispatched.
Also, you should catch the SecurityError thrown when calling BitmapData’s draw() method and use the loaderInfo’s url to change it and use it however you see fit:

var loader:Loader = new Loader();
loader.contentLoaderInfo.addEventListener(Event.COMPLETE, completeHandler);
loader.contentLoaderInfo.addEventListener(SecurityErrorEvent.SECURITY_ERROR, securityError);
loader.load(new URLRequest('yoursite.com/yourfile.swf'),new LoaderContext(true));

function completeHandler(event:Event):void{
    var clone:BitmapData = new BitmapData(1,1);//create a small bitmap to try and draw into
    try{//draw the contents
        clone.draw(event.target.content);
    }catch(error:SecurityError){//expect security error
        trace('SecurityError while loading',event.target.url,'details\n',error.message);    
    }
}
function securityError(event:SecurityErrorEvent):void{
    trace(event.target.url,event);
}

You can also add listeners for IOErrorEvent and HTTPStatusEvent, just in case anything goes wrong (file is missing, wrong url, etc.)