Sanitizing Input in Flash

Kenneth — Wed, 02 Jun 2010 00:17:38 +0000

Let’s say for example you are creating a bulletin board system or some post system from within flash and you would like to restrict the use of any html or special characters. It turns out there is a very simple and elegant way you can strip out or replace any characters you want to.

First we want to declare an array in as3 with all the characters that we don’t want in our string.

var htmlChars:Array = new Array();
 
htmlChars["\\"] = "";
htmlChars["\""] = "";
htmlChars[">"] = "";
htmlChars["<"] = "";

Then all we have to do is to create our function that takes a string as an argument and returns our safe sanitized string.

function sanitizeInput(msg:String):String
{
	for (var htmlChar:Object in htmlChars)
	{
    	     msg = msg.split(htmlChar).join(htmlChars[htmlChar]);
	}
	return msg;
}

Now we can call our function.

var safeString:String = sanitizeInput("

What we can also do is to replace characters in the string. For example…

htmlChars["Bye"] = "CYA";
 
var safeString:String = sanitizeInput("Bye for now\");
// safeString = "CYA for now"

Flash Socket Policy Server

Kenneth — Fri, 19 Mar 2010 17:54:19 +0000

We have a custom built communication server that can handle video/audio and text. Well a while back we wrote a flash client for this server. Well Adobe had just updated their flash player to include some new security enhancements one of which involved not allowing cross domain policy files to be served up via HTTP. There had to be a server listening on port 843 in order to serve the policy file. So I went to task of whipping one up real fast.

        private static TcpListener tcl;
        //Generate policy
        private static string response = "" +
                                    "\0";
        public static void Main(string[] args)
        {
            Console.WriteLine("Starting up server...");
 
            tcl = new TcpListener(IPAddress.Any, 843);
            tcl.Start();
            tcl.BeginAcceptSocket(new AsyncCallback(AcceptCallback), tcl);
            Console.WriteLine("Hit enter/return to close");
            Console.ReadLine();
        }
        private static void AcceptCallback(IAsyncResult ar)
        {
            try
            {
                TcpListener listener = null;
                Socket client = null;
 
                listener = (TcpListener)ar.AsyncState;
                client = listener.EndAcceptSocket(ar);
                NetworkStream ns = new NetworkStream(client);
                StreamReader sr = new StreamReader(ns);
                StreamWriter sw = new StreamWriter(ns);
 
                sr.Read();
                //Send policy
                sw.Write(response);
                sw.Flush();
                ns.Flush();
                //Cleanup
                sw.Close();
                sr.Close();
                ns.Close();
                client.Close();
                //Do it again!
                tcl.BeginAcceptSocket(new AsyncCallback(AcceptCallback), tcl);
            }
            catch (Exception e)
            {
                Console.WriteLine(e.Message);
                return;
            }
        }

So there it is. A quick and dirty flash socket policy server written in c#. You can compile/run this in windows or linux running mono. I’ve been using a modified version of this for quite some time to handle tens of thousands of users and never had a problem with it.

Penguinsoft » flash

Sanitizing Input in Flash

Flash Socket Policy Server