Security sandboxes

Privileges of content in the application sandbox
Privileges of content in non-application sandboxes

AIR provides a comprehensive security architecture that defines permissions for each file in an AIR application. This includes both those files installed with the application and other files loaded by the application. Permissions are granted to files according to their origin, and are assigned to logical security groupings called sandboxes.

Files installed with the application are in a directory known as the application directory, and as such, they are, by default, placed in a security sandbox — known as the application sandbox — that has access to all AIR APIs. This includes APIs that would pose a great security risk if made available to content from sources other than the application resource directory (in other words, files that are not installed with the application).

The AIR security model of sandboxes is composed of the Flash Player security model with the addition of the application sandbox. Files that are not in the application sandbox have security restrictions like those specified by the Flash Player security model.

The runtime uses these security sandboxes to define the range of data that a file may access and the operations it may execute. To maintain local security, the files in each sandbox are isolated from the files of other sandboxes. For example, a SWF file loaded into an AIR application from an external Internet URL is placed into the remote sandbox, and does not by default have permission to script into files that reside in the application directory, which are assigned to the application sandbox.

Note: On iOS, the execution of downloaded code is not permitted.

Privileges of content in the application sandbox

When an application is installed, all files included within an AIR installer file are installed onto the user's computer into an application directory. All files within the application directory tree are assigned to the application sandbox when the application is run. Content in the application sandbox is allowed the full privileges available to an AIR application, including interaction with the local file system.

Many AIR applications use only these locally installed files to run the application. However, AIR applications are not restricted to just the files within the application directory — they can load any type of file from any source. This includes files on the user's computer as well as files from external sources, such as those on a local network or from the Internet. File type has no impact on security restrictions; loaded HTML files have the same security privileges as loaded SWF files from the same source. (However, content in the application sandbox is restricted from loading JavaScript files from outside that sandbox. Details are provided in the developer documentation.)

Content in the application security sandbox has access to AIR APIs that content in other sandboxes is prevented from using. For example, only content in the application security sandbox can read and write to the local file system.

Some JavaScript techniques exist for dynamically transforming strings into executable code. Content in the application security sandbox can only use these techniques while code is loading from application URLs. Using these techniques within the application sandbox would pose a security risk. For example, an application could inadvertently execute a string loaded from a network sandbox, and that string may contain malicious code, such as code to delete or alter files on the user’s computer or to report back the contents of a local file to an untrusted network domain. Details are provided in the developer documentation.

Note: In mobile AIR applications, HTML and JavaScript cannot be loaded into the application sandbox. Mobile AIR applications display such content using the system web control. This control has the same security considerations as the default system web browser.

Privileges of content in non-application sandboxes

Files loaded from a network or Internet location are assigned to a non-application sandbox. Such content behaves with the same set of privileges and restrictions as SWF content running in a web browser (in Flash Player) or HTML content running in a web browser.

Unlike content in the application security sandbox, HTML code in a non-application security sandbox can use JavaScript methods to execute dynamically generated code at any time.

Code in a non-application sandbox does not have access to the privileged AIR APIs that provide application functionality.

Details are provided in the developer documentation.