[whatwg] Some likeness of DOM Session scope --> Steal Flash's SharedObject Syntax

[Ian Hickson]

On Fri, 22 Apr 2005, Brad Neuberg wrote:
>
> Flash MX has a scriptable object named SharedObject that can contain far 
> more application state than a normal cookie can, but for Flash movies.  
> Perhaps this is a good concept to steal from Flash?  They've thought 
> through the API pretty well.  One thing that is unique about these is 
> that they can store binary, so that you can actually serialize the state 
> of your Flash ActionScript (which is just JavaScript now) right into 
> your cookie, making programming in Flash very productive.  You can also 
> store images, sounds, video etc., leading to very fast startup time for 
> apps that use these.

Do you think the API now in the WHATWG spec:

   http://whatwg.org/specs/web-apps/current-work/#client-side

...is good enough? I tried to make it as usable as the Flash API.

I didn't include any specifically binary-related storage features; I 
wasn't really sure what the use case was (in terms of HTML5, I mean), and 
couldn't really see how you would have binary data to store in the first 
place in an HTML document. (Things like images would end up in the 
browser's cache, so wouldn't be an issue.)


> In terms of security, we should be careful that these can't be used as a 
> vector to attack the local system, either through a buffer overflow 
> attack or a way to get a binary image onto a machine that can then be 
> manipulated.

Indeed; I included a detailed security subsection on the topic of issues 
with this feature. Please let me know if you see anything I missed.


> One note: when a user clears their cookies we should also clear out 
> these SharedObjects, probably presenting them to the user as 
> super-charged cookies, to prevent a similar security bug that affected 
> Flash.  There is a sneaky adware attack called PIE that stores cookies 
> into a Flash's SharedObjects, pulling them back out if a user clears 
> their cookies since Flash didn't hook clearing the SharedObjects into 
> clearing the cookies in the browser.

Indeed. I tried to cover this. Let me know if the mention of this is clear 
enough.

Cheers,
-- 
Ian Hickson               U+1047E                )\._.,--....,'``.    fL
http://ln.hixie.ch/       U+263A                /,   _.. \   _\  ;`._ ,.
Things that are impossible just take longer.   `._.-(,_..'--(,_..'`-.;.'