Skip to content

Commit 4af3da7

Browse files
syranidesyranide
committed
React 0.14 compatible
1 parent 68bbbb4 commit 4af3da7

File tree

8 files changed

+240
-172
lines changed

8 files changed

+240
-172
lines changed

‎README.md

Lines changed: 66 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
## ReactSWF ![](https://img.shields.io/github/release/syranide/react-swf.svg) ![](https://img.shields.io/badge/npm-react--swf-blue.svg) ![](https://img.shields.io/badge/bower-react--swf-blue.svg)
22

3-
Shockwave Flash Player component for React.
3+
Shockwave Flash Player component for React. GCC `ADVANCED` optimizations compatible.
44

55
Supports all browsers supported by React.
66

@@ -24,14 +24,14 @@ if (ReactSWF.isFPVersionSupported('10.0')) {
2424
```
2525
```js
2626
// ExternalInterface callbacks are invoked on the DOM node as usual.
27-
var returnValue = thisOrRef.getFPDOMNode().myEICallback(...);
27+
var returnValue = ref.getFPDOMNode().myEICallback(...);
2828
```
2929

3030
## Breaking changes
3131

3232
#### 0.11.0
3333

34-
* React 0.13 components no longer support `swf.getDOMNode()`, use `swf.getFPDOMNode()` instead.
34+
* React 0.13 components no longer support `ref.getDOMNode()`, use `ref.getFPDOMNode()` instead.
3535
* Depends on `Object.is()`, [polyfills are available](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/is).
3636

3737
## Properties
@@ -102,9 +102,38 @@ getFPDOMNode()
102102

103103
## AS3 ExternalInterface
104104

105+
#### Security flaws
106+
```
107+
Escape object key characters for FP:
108+
"&" => "&"
109+
"<" => "&lt;"
110+
"\"" => "&quot;"
111+
112+
Escape object key characters for JS:
113+
"\r" => "\\r"
114+
"\"" => "\\\""
115+
+ wrap key string with "\""
116+
identifiers with keyword names must also be quoted for JS
117+
118+
Escape string characters for JS:
119+
0x005C => "\\\\" (Backslash)
120+
0x2028 => "\\u2028" (Line separator)
121+
0x2029 => "\\u2029" (Paragraph separator)
122+
123+
Invalid UTF8 characters for FP and JS:
124+
0x0000 (NULL character)
125+
0xD800-0xDFFF (Non private use surrogates)
126+
0xFDD0-0xFDEF (Non-characters)
127+
0xFFFE-0xFFFF (Non-characters)
128+
remove or replace with "\uFFFD" (replacement character)
129+
can only be produced by String.fromCharCode(c) in FP, not "\uXXXX" (exception: 0x0000)
130+
```
131+
132+
This list *may* be incomplete.
133+
105134
#### ExternalInterface.addCallback
106135

107-
Returned strings should be encoded using `encodeStringForJS`.
136+
Returned strings should be encoded using `StringForJS.encode`.
108137

109138
You must provide a unique DOM `id` to `ReactSWF` for IE8-10.
110139

@@ -114,48 +143,42 @@ You must provide a unique DOM `id` to `ReactSWF` for IE8-10.
114143

115144
#### ExternalInterface.call
116145

117-
String arguments should be encoded using `encodeStringForJS`.
146+
String arguments should be encoded using `StringForJS.encode`.
118147

119-
#### encodeStringForJS
148+
#### StringForJS.encode
120149

121-
The Flash run-time does not sufficiently encode strings passed to JavaScript. This can cause run-time errors, string corruption or character substitution to occur.
150+
The Flash run-time does not sufficiently encode strings passed to JavaScript. This can cause run-time errors, string corruption or character substitution to occur. Encoded strings are transparently decoded by the JavaScript run-time.
122151

123-
`encodeUnicodeStringForJS` should be used when the string is untrusted or contains special characters.
124-
`encodeASCIIStringForJS` is a cheap alternative when the string is trusted or sufficiently sanitized.
125-
126-
Encoded strings are transparently decoded by the JavaScript run-time.
127-
128-
```as3
129-
var ENCODE_UNSAFE_ASCII_CHARS_REGEX:RegExp = /\\/g;
130-
131-
// Encode unsafe ASCII-chars for use with ExternalInterface.
132-
// \0 is not encoded and may throw a JavaScript error or corrupt the string.
133-
function encodeASCIIStringForJS(value:String):String {
134-
return value.replace(ENCODE_UNSAFE_ASCII_CHARS_REGEX, '\\\\');
135-
}
136-
```
137152
```as3
138-
var ENCODE_UNSAFE_UNICODE_CHARS_REGEX:RegExp = new RegExp(
139-
// Backslash (\) and NULL-char (\0)
140-
'[\\\\\\0' +
141-
// Line separator (0x2028), paragraph separator (0x2029)
142-
String.fromCharCode(0x2028) + String.fromCharCode(0x2029) +
143-
// Non-characters (0xFDD0 - 0xFDEF)
144-
String.fromCharCode(0xfdd0) + '-' + String.fromCharCode(0xfdef) +
145-
// Non-characters (0xFFFE + 0xFFFF)
146-
String.fromCharCode(0xfffe) + String.fromCharCode(0xffff) + ']',
147-
'g'
148-
);
149-
150-
// Encode unsafe Unicode-chars for use with ExternalInterface.
151-
// 0xD800-0xDFFF are considered invalid and may be substituted with 0xFFFD.
152-
function encodeUnicodeStringForJS(value:String):String {
153-
return value.replace(ENCODE_UNSAFE_UNICODE_CHARS_REGEX, function():String {
154-
var charCode:Number = arguments[0].charCodeAt(0);
155-
return (
156-
charCode === 92 ? '\\\\' :
157-
charCode === 0 ? '\\0' : '\\u' + charCode.toString(16)
158-
);
159-
});
153+
public class StringForJS {
154+
private static var UNSAFE_CHARS_REGEX:RegExp = new RegExp(
155+
// NULL-char (0x00) and backslash (0x5C)
156+
"[\\x00\\\\" +
157+
// Line separator (0x2028), paragraph separator (0x2029)
158+
"\u2028-\u2029" +
159+
// Non private use surrogates (0xD800 - 0xDFFF)
160+
String.fromCharCode(0xD800) + "-" + String.fromCharCode(0xDFFF) +
161+
// Non-characters (0xFDD0 - 0xFDEF)
162+
String.fromCharCode(0xFDD0) + "-" + String.fromCharCode(0xFDEF) +
163+
// Non-characters (0xFFFE + 0xFFFF)
164+
String.fromCharCode(0xFFFE) + String.fromCharCode(0xFFFF) + "]",
165+
"g"
166+
);
167+
168+
private static function unsafeCharEscaper():String {
169+
switch (arguments[0]) {
170+
case "\u0000": return "\\0";
171+
case "\u005C": return "\\\\";
172+
case "\u2028": return "\\u2028";
173+
case "\u2029": return "\\u2029";
174+
default: return "\uFFFD";
175+
};
176+
}
177+
178+
// Encode unsafe strings for use with ExternalInterface. Invalid characters
179+
// are substituted by the Unicode replacement character.
180+
public static function encode(value:String):String {
181+
return value.replace(UNSAFE_CHARS_REGEX, unsafeCharEscaper);
182+
}
160183
}
161184
```

‎bower.json

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "react-swf",
3-
"version": "0.11.1",
3+
"version": "0.12.0",
44
"license": "MIT",
55
"description": "Shockwave Flash Player component for React",
66
"authors": ["Andreas Svensson <andreas@syranide.com>"],
@@ -12,7 +12,7 @@
1212
"url": "https://github.com/syranide/react-swf"
1313
},
1414
"dependencies": {
15-
"react": "^0.13"
15+
"react": ">=0.14"
1616
},
1717
"keywords": [
1818
"react",

‎npm-react-swf/README.md

Lines changed: 66 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
## ReactSWF ![](https://img.shields.io/npm/v/react-swf.svg)
22

3-
Shockwave Flash Player component for React.
3+
Shockwave Flash Player component for React. GCC `ADVANCED` optimizations compatible.
44

55
Supports all browsers supported by React.
66

@@ -24,14 +24,14 @@ if (ReactSWF.isFPVersionSupported('10.0')) {
2424
```
2525
```js
2626
// ExternalInterface callbacks are invoked on the DOM node as usual.
27-
var returnValue = thisOrRef.getFPDOMNode().myEICallback(...);
27+
var returnValue = ref.getFPDOMNode().myEICallback(...);
2828
```
2929

3030
## Breaking changes
3131

3232
#### 0.11.0
3333

34-
* React 0.13 components no longer support `swf.getDOMNode()`, use `swf.getFPDOMNode()` instead.
34+
* React 0.13 components no longer support `ref.getDOMNode()`, use `ref.getFPDOMNode()` instead.
3535
* Depends on `Object.is()`, [polyfills are available](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/is).
3636

3737
## Properties
@@ -102,9 +102,38 @@ getFPDOMNode()
102102

103103
## AS3 ExternalInterface
104104

105+
#### Security flaws
106+
```
107+
Escape object key characters for FP:
108+
"&" => "&amp;"
109+
"<" => "&lt;"
110+
"\"" => "&quot;"
111+
112+
Escape object key characters for JS:
113+
"\r" => "\\r"
114+
"\"" => "\\\""
115+
+ wrap key string with "\""
116+
identifiers with keyword names must also be quoted for JS
117+
118+
Escape string characters for JS:
119+
0x005C => "\\\\" (Backslash)
120+
0x2028 => "\\u2028" (Line separator)
121+
0x2029 => "\\u2029" (Paragraph separator)
122+
123+
Invalid UTF8 characters for FP and JS:
124+
0x0000 (NULL character)
125+
0xD800-0xDFFF (Non private use surrogates)
126+
0xFDD0-0xFDEF (Non-characters)
127+
0xFFFE-0xFFFF (Non-characters)
128+
remove or replace with "\uFFFD" (replacement character)
129+
can only be produced by String.fromCharCode(c) in FP, not "\uXXXX" (exception: 0x0000)
130+
```
131+
132+
This list *may* be incomplete.
133+
105134
#### ExternalInterface.addCallback
106135

107-
Returned strings should be encoded using `encodeStringForJS`.
136+
Returned strings should be encoded using `StringForJS.encode`.
108137

109138
You must provide a unique DOM `id` to `ReactSWF` for IE8-10.
110139

@@ -114,48 +143,42 @@ You must provide a unique DOM `id` to `ReactSWF` for IE8-10.
114143

115144
#### ExternalInterface.call
116145

117-
String arguments should be encoded using `encodeStringForJS`.
146+
String arguments should be encoded using `StringForJS.encode`.
118147

119-
#### encodeStringForJS
148+
#### StringForJS.encode
120149

121-
The Flash run-time does not sufficiently encode strings passed to JavaScript. This can cause run-time errors, string corruption or character substitution to occur.
150+
The Flash run-time does not sufficiently encode strings passed to JavaScript. This can cause run-time errors, string corruption or character substitution to occur. Encoded strings are transparently decoded by the JavaScript run-time.
122151

123-
`encodeUnicodeStringForJS` should be used when the string is untrusted or contains special characters.
124-
`encodeASCIIStringForJS` is a cheap alternative when the string is trusted or sufficiently sanitized.
125-
126-
Encoded strings are transparently decoded by the JavaScript run-time.
127-
128-
```as3
129-
var ENCODE_UNSAFE_ASCII_CHARS_REGEX:RegExp = /\\/g;
130-
131-
// Encode unsafe ASCII-chars for use with ExternalInterface.
132-
// \0 is not encoded and may throw a JavaScript error or corrupt the string.
133-
function encodeASCIIStringForJS(value:String):String {
134-
return value.replace(ENCODE_UNSAFE_ASCII_CHARS_REGEX, '\\\\');
135-
}
136-
```
137152
```as3
138-
var ENCODE_UNSAFE_UNICODE_CHARS_REGEX:RegExp = new RegExp(
139-
// Backslash (\) and NULL-char (\0)
140-
'[\\\\\\0' +
141-
// Line separator (0x2028), paragraph separator (0x2029)
142-
String.fromCharCode(0x2028) + String.fromCharCode(0x2029) +
143-
// Non-characters (0xFDD0 - 0xFDEF)
144-
String.fromCharCode(0xfdd0) + '-' + String.fromCharCode(0xfdef) +
145-
// Non-characters (0xFFFE + 0xFFFF)
146-
String.fromCharCode(0xfffe) + String.fromCharCode(0xffff) + ']',
147-
'g'
148-
);
149-
150-
// Encode unsafe Unicode-chars for use with ExternalInterface.
151-
// 0xD800-0xDFFF are considered invalid and may be substituted with 0xFFFD.
152-
function encodeUnicodeStringForJS(value:String):String {
153-
return value.replace(ENCODE_UNSAFE_UNICODE_CHARS_REGEX, function():String {
154-
var charCode:Number = arguments[0].charCodeAt(0);
155-
return (
156-
charCode === 92 ? '\\\\' :
157-
charCode === 0 ? '\\0' : '\\u' + charCode.toString(16)
158-
);
159-
});
153+
public class StringForJS {
154+
private static var UNSAFE_CHARS_REGEX:RegExp = new RegExp(
155+
// NULL-char (0x00) and backslash (0x5C)
156+
"[\\x00\\\\" +
157+
// Line separator (0x2028), paragraph separator (0x2029)
158+
"\u2028-\u2029" +
159+
// Non private use surrogates (0xD800 - 0xDFFF)
160+
String.fromCharCode(0xD800) + "-" + String.fromCharCode(0xDFFF) +
161+
// Non-characters (0xFDD0 - 0xFDEF)
162+
String.fromCharCode(0xFDD0) + "-" + String.fromCharCode(0xFDEF) +
163+
// Non-characters (0xFFFE + 0xFFFF)
164+
String.fromCharCode(0xFFFE) + String.fromCharCode(0xFFFF) + "]",
165+
"g"
166+
);
167+
168+
private static function unsafeCharEscaper():String {
169+
switch (arguments[0]) {
170+
case "\u0000": return "\\0";
171+
case "\u005C": return "\\\\";
172+
case "\u2028": return "\\u2028";
173+
case "\u2029": return "\\u2029";
174+
default: return "\uFFFD";
175+
};
176+
}
177+
178+
// Encode unsafe strings for use with ExternalInterface. Invalid characters
179+
// are substituted by the Unicode replacement character.
180+
public static function encode(value:String):String {
181+
return value.replace(UNSAFE_CHARS_REGEX, unsafeCharEscaper);
182+
}
160183
}
161184
```

‎npm-react-swf/package.json

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "react-swf",
3-
"version": "0.11.1",
3+
"version": "0.12.0",
44
"license": "MIT",
55
"description": "Shockwave Flash Player component for React",
66
"author": "Andreas Svensson <andreas@syranide.com>",
@@ -12,7 +12,7 @@
1212
"url": "https://github.com/syranide/react-swf"
1313
},
1414
"peerDependencies": {
15-
"react": "^0.13"
15+
"react": ">=0.14"
1616
},
1717
"keywords": [
1818
"react",

0 commit comments

Comments
 (0)