Windows UNC Paths Can Be Loaded By Flash Player
Wed, 12 May 2010 22:04:21 EST
So basically if you know the Windows computer name (or IP address on Vista and higher), you can directly access a Windows shared resource. The screen shot is of my shared resources. My computer name is mosfet-monster. (A mosfet is one of the most powerful types of modern transistors).
Except for quick access, this normally isn't something very helpful for the home user. However it can come in very handy on large corporate networks or when programming applications that will always reside on a local LAN or when doing command line magic for printing.
I am currently working on a Flash project at work that requires previewing user images that were saved to a Windows network share from several exhibit kiosks. Despite the fact that the images are unavailable on a mapped drive, web server, or any other typical resource for Flash; I was amazed that I was able to resolve a windows UNC path and load the image from a Windows network share!
I used a typical loader and URLRequest to resolve the path. So I am currently able to load images using the following example path: \\MachineName\SharedFolderName\ImageName.png or .jpg
This functionality isn't documented anywhere that I could find in the Adobe Actionscript 3 language references. Nice work for once Adobe!
Comments
Ian,
I thought about this a little more. The security implications of being able to resolve UNC paths from web page based swf's is a security nightmare.
I am pretty sure the security sandbox in Flash player will help prevent against that. The only way I know of getting files off to a remote location after you load them into a normal Flash application without the air framework is using the FileReference class.
This class only allows POST type form submission after a file selection dialog is presented to the user. However, if you were good with a media server I think you may actually be able to use the Netconnection.Call to pass the UNC path based loaded information to a remote server application, cast it properly on the server, and save the files.
Pretty scary.
Personally, I use UNC paths in AIR and projector based applications on museum kiosks. The threat model is a little different in that sort of constrained environment.
Are you sure about the FLV video over UNC Ian? I am using this very technique with projector applications made using the latest version of Flash player 10.
I have used this technique to SMB shares on a debian linux machine as well as on Windows Server 2008 R2.
You may be right for swf based web applications or non AIR applications.
Thanks for the valuable comment.
Be careful though - a couple of years ago Adobe disowned UNC support in Flash - you'll see this in particular in trying to get FLV video to run over UNC. They also stated that local file-server access was not supported, so there's a big question mark over mapped drive access in the future...
Comments are currently disabled.
