From: Phillip Gawlowski <cmdjackryan@...>
Date: 2007-04-25T17:27:12+09:00
Subject: Re: Using Watir and Ruby2Exe together

Jim Clark wrote:

> The specification targets IE6, IE7 and Firefox running on XP and Vista. 
> The catch is that none of these browsers allows files to be written to 
> disk for security reasons regardless if Java applets, JavaScript, 
> ECMAScript, etc. are used. So the problem is once the form is submitted 
> and the Flash Action Script has the output XML ready, how to circumvent 
> security and get the XML file written to preferably the same drive and 
> directory the application was launched from.
> 
> Having never programmed in Flash Action Script, my first hopefully 
> correct assumption is that Flash will be able to call an executable 
> created by Ruby2Exe from the browser to execute it. If so, the 

Flash won't be able to do that. Firstly, Adobe would make it trivial to 
create malicious website, and secondly, Flash is handled just like any 
other browser plug-in. If you want to use a browser exploit, you are on 
the wrong list.

> executable could be Watir programmed to open a new browser window, 
> Action Script sending the XML output to the browser window, and then 
> Watir doing a "Save Page As...", and then Watir closing the browser 
> window and returning control to the Flash application to do its thing 
> from there.

A possible solution would be a multi-threaded Ruby application, which a) 
starts the browser (from the USB thumbdrive, for example) and b) polls 
the browser if the XML file is ready, and then writes it to the 
thumbdrive / any other place.

> A key assumption in this sequence is that once Watir opens the browser 
> window, Action Script can communicate with the new window to pipe the 
> XML output (standard UTF-8) to it.  Perhaps a simpler scenario is if 
> Action Script can open the executable and pass through ARGV either the 
> XML output or the form parameters (if the XML is too big for ARGV), Ruby 
> can do all the lifting without Watir and simply create and/or write the 
> output file.

I very much doubt that this will work, for various security reasons. 
It's probably a smart idea to ask this question on security-basics on 
securityfocus.com

Keep in mind though, that you should restrict all activity to your 
hardware, and don't use a customer's system. Not even with permission. 
The sysadmins probably won't take kindly to anything that accesses their 
systems, for various (security related) issues.

Again, refer your questions to security-basics, too.

> Is what I described possible? Are there other solutions for 
> accomplishing this? The application is nearing completion and this piece 
> is becoming trickier than expected.

P5: Proper Planning Prevents Poor Performance.

The only thing that comes to mind, would be to pop up a Save as.. dialog 
from within ActionScript, if possible. Anything beyond that is more 
likely than not outside of ActionScript's control, but could be 
"captured" by using Watir / FireWatir.

To me, though, this concept smells like bad planning by the higher-ups.

-- 
Phillip "CynicalRyan" Gawlowski
http://cynicalryan.110mb.com/
http://clothred.rubyforge.org

Eek! That was supposed to be My Special Law, _MY_ special law, I tell
you!

T/