Question

I have a script that retrieves objects from a remote server through an Ajax call. The server returns objects in JSON notation.­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­

However, in Adobe AIR, there is a restriction on using eval() for security reasons. So I'm able to get replies from the remote server, but can't turn them back into JavaScript objects. Is there any workaround for this issue? I would like to use JSON for my JavaScript objects, since it can be used almost immediately.

Side-note : I do understand the security implications for forcing the issue, but I will be doing some rapid application development for a competition, so the program would only be a quick prototype, and not used for production purposes. Nevertheless, it would be great if there's a better alternative to what I'm trying to do now


Update:

Thanks to Theo and jsight for their answers;

One important thing I learnt today is that I can actually make use of ActionScript libraries by using the

<script src="lib/myClasses.swf" type="application/x-shockwave-flash"></script>
tag extended by Adobe AIR. Check out Theo's link for more details!

Was it helpful?

Solution

You can find a JSON parser written in JavaScript here (source code here). You can also use the as3corelib JSON parser from JavaScript, there's a description of how to access ActionScript libraries from JavaScript here.

OTHER TIPS

The current AIR release (v2.5) bundles a newer WebKit that has native JSON support, via JSON.stringify() and JSON.parse().

Have you looked at as3corelib? It appears to provide an AS3 parser for JSON data, and my hope would be that it doesn't rely upon eval (eval tends to be bad for security as you noted). There are similar libs for Javascript as well, and they tend to be the preferred way to parse json due to the security implications of calling eval on (potentially) evil data.

JSON is Javascript Object Notation, so if you are using Javascript you are already there! Have a look at these links, they give examples of how to create Javascript objects from JSON:

http://www.hunlock.com/blogs/Mastering_JSON_(_JavaScript_Object_Notation_)

http://betterexplained.com/articles/using-json-to-exchange-data/

If you decide to go the Flex / AS3 route, then as the jsight said, as3corelib is a good place to start.

I think this is possible if you use an iframe and sandbox bridge. You should be able to run eval() on downloaded code in the sandboxed iframe,

Excerpt from Adobe AIR 1.1 Doc's "...it may be more convenient to run content in a sandboxed child frame so that the content can be run with no restrictions on eval()..."

Another related article: Building on AIR: Working with the Sandbox Bridges

Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top