bugGnash - The GNU Flash player - Bugs: bug #31574, Can't run downloaded swf...

 
 

bug #31574: Can't run downloaded swf (SECURITY: starting url is not a local resource)

Submitted by:  Tim Retout <diocles>
Submitted on:  Sun 07 Nov 2010 12:47:41 AM UTC  
 
Category: NoneSeverity: 3 - Normal
Release: masterStatus: Wont Fix
Privacy: PublicAssigned to: None
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Tue 22 Feb 2011 02:33:11 PM UTC, comment #11:

I guess we'll stick with what we have now then.

Benjamin Wolsey <bwy>
Project Member
Mon 08 Nov 2010 09:38:13 AM UTC, comment #10:

I can confirm that it was due to VM::isInitialized() allowing this check to be omitted for the first SWF.

This was a hack that used a truly awful design to do something quite useful, and now the singletons have all gone there isn't a ready-made way to do it. The options are: stick with what we have now, which is consistent but awkward, or add a way to disable this check and do so for the initial SWF. Any preferences?

Benjamin Wolsey <bwy>
Project Member
Mon 08 Nov 2010 08:32:32 AM UTC, comment #9:

But that doesn't explain why -u works for the reporter when -U doesn't.

Benjamin Wolsey <bwy>
Project Member
Mon 08 Nov 2010 08:24:37 AM UTC, comment #8:

-u is used as -U if -U isn't given.

Sandro Santilli <strk>
Project Member
Mon 08 Nov 2010 08:14:21 AM UTC, comment #7:

It shows I was wrong about the -u not being used to resolve URLs though; I guess this is for movie loads, since we verified that the base URL (-U) is used for loading XML.

Benjamin Wolsey <bwy>
Project Member
Mon 08 Nov 2010 08:12:37 AM UTC, comment #6:

It's not about whether it's an allowed resource or not (this is to do with adding a sandbox path, which is still done).

It's the fact that the specified original URL (passed using -u) is a non-local file, yet the first file loaded is a local file, and this is forbidden by the URLAccessManager.

I'm pretty sure we always used to check against this URL. The only difference I can think of is that the static VM::isInitialized() would have evaluated to false at the time of the first check, so the check could be omitted for the first SWF loaded only (i.e. the starting SWF). Now if I can work out how to view older revisions with git I'll try to confirm.

Benjamin Wolsey <bwy>
Project Member
Sun 07 Nov 2010 09:57:41 PM UTC, comment #5:

Just to confirm, git bisect blames 1d9727a for the change. Passing the file via STDIN (using '-' for the URL, and -u as well) works.

Tim Retout <diocles>
Sun 07 Nov 2010 06:54:16 PM UTC, comment #4:

Yeah, might be annoying. Anyway, use standard input and it'll work.
I belive we used to add the command-line given path to the list of allowed resources for this specific purpose. Duno if we're still doing it.

Sandro Santilli <strk>
Project Member
Sun 07 Nov 2010 04:59:30 PM UTC, comment #3:

Having said that, with just '-U', the SWF doesn't run properly when downloaded - it seems to miscalculate the URLs it's looking for.

With 0.8.8, I'm able to change the '-U' for a '-u', and get it to work - with git master, when I do that, I get the SECURITY warning. From my reading of the man page, this is what '-u' is meant for, no?

So I think this behaviour has changed, and might mean there's no reliable way to run downloaded SWFs right now. I'll try to find out which commit changed it.

Tim Retout <diocles>
Sun 07 Nov 2010 04:10:32 PM UTC, comment #2:

Well, that's embarrassing - the '-u' wasn't meant to be there (but I'm sure I did try it with just '-U', with the same problem).

Anyway, after a rebuild it all seems to work. I'll let you know if I see it again.

Tim Retout <diocles>
Sun 07 Nov 2010 08:05:06 AM UTC, comment #1:

The -U argument should be used to resolve URLs, but shouldn't prevent any SWFs from loading. The -u argument is used to specify a real SWF URL when Gnash loads from a file descriptor. This one is used to decide whether a load is allowed from the filesystem or not. Your command line ought to work if -u isn't specified, and that shouldn't have any other effects on the running of the SWF.

If dropping -u doesn't work, it's a bug. Otherwise, even if the behaviour has changed since 0.8.8, I don't think this is a bug (but would be happy to be convinced otherwise).

Benjamin Wolsey <bwy>
Project Member
Sun 07 Nov 2010 12:47:41 AM UTC, original submission:

I'm having trouble running a local copy of a downloaded swf. (I want to be able to edit the swf to isolate testcases from it.)

The two relevant lines in the debug output are:

3398:1] 12:51:21 SECURITY: Checking security of URL 'file:///home/tim/src/gnu/gnash/iplayer/player.swf/player-18269_21576.swf'
3398:1] 12:51:21 SECURITY: Load of file /home/tim/src/gnu/gnash/iplayer/player.swf/player-18269_21576.swf forbidden (starting url http://www.bbc.co.uk/iplayer/episode/b00vky79/Off_the_Page_Living_Cheap/ is not a local resource)

I've attached my two scripts to show how I'm trying to run gnash - 'run' works, but 'run2' gives the above errors. (I haven't attached the cookies file for the moment.) I've tried '-u' instead of '-U', but that didn't seem to help.

I'm using git master (821944e) - run2 seems to work with Debian's 0.8.8 package, so this might have been a recent regression. I'm currently suspecting commit 1d9727ab (removing VM singleton) which touched the function containing that error message - but haven't bisected to prove this yet.

Tim Retout <diocles>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #21954:  run2 added by diocles (1KiB - application/octet-stream)
file #21953:  run added by diocles (1KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by strk (Posted a comment)
  • -unavailable- added by bwy (Posted a comment)
  • -unavailable- added by diocles (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 5 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Tue 22 Feb 2011 02:33:11 PM UTCbwyStatusConfirmed=>Wont Fix
      Open/ClosedOpen=>Closed
    Mon 08 Nov 2010 09:38:13 AM UTCbwyStatusNone=>Confirmed
    Sun 07 Nov 2010 12:47:42 AM UTCdioclesAttached File-=>Added run, #21953
      Attached File-=>Added run2, #21954

    Back to the top


    Powered by Savane 3.1-cleanup1