@%#$! Flash player security policy and more?

Question

Information Security

Hello hackers.
Help me solve the problem, I've been fighting for three hours, no less.
What do I want to do?
I want to make some kind of wrapper.
Those. the flash drive loads another flash drive inside itself, then work with the loaded flash drive (addChild, interactive).
I use the following code in wrapper:

public function Main():void <br/>
{<br/>
 if (stage) init();<br/>
 else this.addEventListener(Event.ADDED_TO_STAGE, init);<br/>
}<br/>
 <br/>
public function init(event:Event = null):void<br/>
{<br/>
 this.removeEventListener(Event.ADDED_TO_STAGE, init);<br/>
 <br/>
 stage.dispatchEvent(new Event(Event.DEACTIVATE)); <br/>
 stage.dispatchEvent(new Event(Event.ACTIVATE));<br/>
 <br/>
<br/>
loadExeption();<br/>
}<br/>
 <br/>
public function loadExeption():void<br/>
{<br/>
 <br/>
 Security.allowDomain(&quot;*&quot;); <br/>
 Security.allowInsecureDomain(&quot;*&quot;);<br/>
<br/>
loaderContext = new LoaderContext();<br/>
 loaderContext.checkPolicyFile = true;<br/>
 <br/>
 if (Security.sandboxType != 'localTrusted') <br/>
 {<br/>
 loaderContext.applicationDomain = ApplicationDomain.currentDomain;<br/>
 loaderContext.securityDomain = SecurityDomain.currentDomain;<br/>
 }<br/>
 <br/>
 m_loader = new Loader();<br/>
 m_loader.contentLoaderInfo.addEventListener(Event.COMPLETE, onCompleteHandler);<br/>
<br/>
m_loader.load(new URLRequest(&quot;xxx.ru/my.swf&quot;), loaderContext);<br/>
 }<br/>
<br/>
public function onCompleteHandler(e:Event):void<br/>
{<br/>
 addChild(m_loader);<br/>
}

Everything seems to be correct, there are no compilation errors, realtime errors too.
And what is wrong?
It's not that it doesn't work. After running such code, the flash begins to cruelly lich into memory, and it seems that it loads itself.
Wrapper's (Preloader's) address: xxx.ru/preloader.swf (conditional).
The address of the loaded swf-shki: xxx.ru/my.swf (conditionally).
They lie on the same domain, next to them lies:
crossdomain.xml, listing:

&lt;cross-domain-policy&gt;<br/>
&lt;site-control permitted-cross-domain-policies=&quot;master-only&quot;/&gt;<br/>
&lt;allow-http-request-headers-from domain=&quot;xxx.ru&quot; headers=&quot;*&quot;/&gt;<br/>
&lt;allow-access-from domain=&quot;xxx.ru&quot; to-ports=&quot;80&quot;/&gt;<br/>
&lt;/cross-domain-policy&gt;

I use swfobject.js, in index.html (index.php) a piece of code responsible for the flash drive:

...<br/>
 var params = {<br/>
 menu: &quot;false&quot;,<br/>
 scale: &quot;noScale&quot;,<br/>
 allowFullscreen: &quot;true&quot;,<br/>
 allowScriptAccess: &quot;always&quot;,<br/>
 allowNetworking: &quot;always&quot;,<br/>
 bgcolor: &quot;#000000&quot;<br/>
 };<br/>
 ...<br/>
 swfobject.embedSWF(&quot;preloader.swf&quot;, &quot;altContent&quot;, &quot;600&quot;, &quot;580&quot;, &quot;10.0.0&quot;, &quot;expressInstall.swf&quot;, flashvars, params, attributes);<br/>

The second flash drive has an added_to_stage event, a crutch with activation / deactivation.
The most interesting thing is that locally it all works fine.
Those. I upload my.swf to the hosting, locally compile preloader.swf - it works with a bang. As soon as I upload preloader.swf to the hosting, this situation arises. Who faced?

Answer 1

I actually found the solution myself.
Solution:
The main class of the loaded flash drive must be different from the main wrapper class. In my case it was Main<->Main. Actually, there were such glitches.
It was worth changing to Wrapper <-> Main, as everything worked.