The polyfill.js is a popular open source library to support older browsers. 100K+ sites embed it using the cdn.polyfill.io domain. Notable users are JSTOR, Intuit and World Economic Forum. However, in February this year, a Chinese company bought the domain and the Github account. Since then, this domain was caught injecting malware on mobile devices via any site that embeds cdn.polyfill.io. Any complaints were quickly removed (archive here) from the Github repository.
Flash didn’t allow arbitrary code to run. It had a very limited scripting language (which design-wise is superior to JavaScript, by the way) to control canvas elements and playing sound. You couldn’t execute programs on your computer.
If by late you mean right before action script 2. I was making flash games back then and I remember it being unable to access virtually anything without first triggering a prompt, which you could disable by right clicking, and going into properties.
Yes, through NoScript. And it should be blocked, not blockable.
It is funny you mention evercookie because that was a JavaScript library, and affected all cookies, not just flash cookies.
Flash cookies being sharable between browsers was bad, but you could still easily clear those cookies, that is until a certain JavaScript library started restoring them automatically.
Mate, actionscript was not only basically JavaScript with adobe vendor extensions, but it was literally a programming language! If that’s not arbitrary code, then you’ve got a crazy definition of what is! You’ve kinda unequivocally demonstrated that you have no idea what you’re talking about at this point, I’m afraid.
And way to completely misunderstand the evercookie. The flash part was how it could jump between browsers, no browser cookie can do that. It was a combination of everything that made it such a problem.
Arbitrary code execution is a vulnerability where you write and execute arbitrary code outside of the intended environment
Just because Actionscript is a language doesn’t mean it has the functionality to do whatever to your machine. It lacks most of those functions because it is mostly a graphics library. It would have to run an already prepared external script via some improper memory pointer somewhere for it to be arbitrary code execution.
And Actionscript is not built on top of JavaScript. Both JavaScript and ActionScript are based on ecmascript. They are different, just like Typescript and JavaScript are different.
Actionscript was object oriented and had proper types unlike JavaScript which to this day is one of the worst programming languages.
Are you sure I’m the one misunderstanding the problem of evercookie? Was the problem that you could access the same cookies from multiple browsers because of ActionScript, or was it that evercookie maliciously restored said deleted cookies after they were supposed to no longer be used? One is a feature that allows transferring sessions between browsers on the same computer. The other is essentially malware.
ECMAscript is based on JavaScript
I’m not gonna bother entertaining the rest of your post, you can’t seem to even get the basics right
Ecmascript was made to standardize JavaScript, but it isn’t based on JavaScript. Actionscript is then based on ecmascript, making Actionscript a sibling to JavaScript, not a subset.