Flash Player SecurityError: Error #2060

This post starts with a security error echoed by Flash Player: I'm talking about Error #2060, an error that is associated with the use of ExternalInterface.call.

For those of you that just don't remember what ExternalInterface is responsible of, I have to say that this class allows ActionScript to "talk" with the Flash Player container: in my current example, I was calling a JavaScript function from inside ActionScript. My idea was to allow ActionScript to run a user-specified Windows program through the intermediation of the ActiveX WScript.Shell, instantiated in a IE-managed HTML page.

So, the code for the ActionScript part looked like this:

<?xml version="1.0" encoding="utf-8"?>
<mx:Application xmlns:mx="http://www.adobe.com/2006/mxml"
layout="absolute" width="402" height="22"
backgroundColor="white">
<mx:Script>
<![CDATA[
private static const JS_FUNCTION_NAME: String = "jsRunProgram";

private function callExternalProgram(programName:String):void {
    if (ExternalInterface.available) {
        ExternalInterface.call(JS_FUNCTION_NAME, programName);
    }
}
]]>
</mx:Script>
<mx:Label text="External program to call:"
y="0"
fontWeight="bold"/>
<mx:TextInput id="txtProgramName"
 text="notepad"
x="151" y="-2" width="198"
enter="callExternalProgram(txtProgramName.text)"/>
<mx:Button label="Run" x="352" y="-2"
click="callExternalProgram(txtProgramName.text)"/>
</mx:Application>

... and inside HTML page I had this JavaScript fragment:

<script language="javascript" >
 function jsRunProgram(programName) {
  shellObj = new ActiveXObject("WScript.Shell");
  shellObj.run(programName);
 }
</script>

The idea here is not obvious, but pretty simple: the user enters a program name in a Flex TextInput, then presses the Enter key and voilà... ActionScript calls the JavaScript function jsRunProgram providing it with the text just entered by the user. JavaScript, in turn, instantiates the ActiveX WScript.Shell and instructs it to run the program entered by the user. This way, ActionScript can run every Windows program the user typed: notepad, iexplore, cmd... just to name a few.

I developed this solution inside Adobe Flex Builder. Now, when I opened inside the Flex Builder browser the HTML page containing the Flash control corresponding to the ActionScript code, all ran as expected. Cool!

The surprise came out when I closed the Flex Builder browser and tried to open the same page in IE. I couldn't believe my eyes: everytime ActionScript tried to call JavaScript a Flash error popped out complaining about error 2060: Security sandbox violation.

This behavior sounded so unbelievable to me for several reasons:

1. Inside Flex Builder browser it ran without problems
2. I couldn't imagine why Flash player had security concerns for accessing its containing HTML page.

I spent about a half weekend finding a solution.

Firstly, I browsed the Internet and I discovered that the same problem is not so uncommon. Some people suggest to deploy all the files in a web sever and, instead of accessing the HTML page via file system, access it via a HTTP connection to the web server. They say it works, but I was not interested in that solution primarily because I didn't want to introduce a web server. So I didn't try that solution.

I found two different solutions.

The first:

1. Change Flash Player security settings to allow it to access the local directory containing the HTML page. (To change Flash Player settings it's required to call this URL)
   
2. Change IE security settings to allow the use of ActiveX WScript.Shell

The second:

1. Rename the HTML page to HTA.
   

How to call a program as Windows service

It's really easy to call a program as a Windows service.
In order to proceed, you firstly need two programs: instsrv.exe and srvany.exe. These programs are produced by Microsoft and are parts of Windows Resource Kit Tools.

To call a program as a new Windows service, follow this procedure:

1. Create a new directory, let's say winsrv, on drive c
2. Store both instsrv.exe and srvany.exe on that directory
3. Open a DOS window
4. Type: cd /d c:\winsrv
5. Type: instsrv "service name" c:\winsrv\srvany.exe
6. Exit from DOS window
7. Open regedit
8. Navigate to this key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\service name
9. Add a new key: Parameters
10. Under the key Parameters, add these three string values: Application AppDirectory AppParameters
11. Set the AppDirectory value to the directory where the program is stored into
12. Set the Application value to the program name
13. Set the AppParameters value to the command line parameters passed in program invocation

NOTE
In order to run the specified program, you may provide additional authentication information. This can be accomplished specifying log on parameters in the service properties.

To remove the new service, just follow this procedure:

1. Open a DOS window
2. Type cd /d c:\winsrv
3. Type instsrv "service name" remove