Retrieving directory listing using Flash
In Flash, you can open a file on the user's computer. In Flash 9, you can upload and download a file, and in Flash 10, you can access the contents of a file.
This is safe because the user must select the file from the file dialog to allow access to it.
What I would like to do in my application is to get the list of file / subdirectory directories in a directory. This is no different than uploading a user-selected file to display the contents of a user-selected directory, so I don't see any security implications. I don't need to access the files, just list them,
But it looks like it can't be in a flash? Am I right or am I missing something?
I can always use a signed java applet if needed, but flash seems more appropriate for my particular application, so I thought it might be worth asking a question.
source to share
It's unsafe unless perhaps you ask the user to specify the desired directory with a folder browse dialog if we stay with the above logic ...
Even they, users can inadvertently provide more information than they should with this average.
For example, when they open all the "Documents and Settings" folders on P2P networks ... :-)
Insecure because then people might get interesting filenames, perhaps examine browser caches, etc.
source to share