32 CHAPTER 1 Developing and loading sub-applications In sandboxed applications, each sub-application is loaded into a separate application domain and a separate security domain. The interoperability across security domains is very limited. The sub-application cannot access most stage properties, methods, and events. It cannot get mouse and keyboard events from other security domains. It also cannot perform drag and drop operations to or from the main application, and pop-up controls are clipped at the boundaries of the sub-application. Data sharing between the main application and sub-application requires marshaling. If you try to use the parent chain of an application object to access properties of the main application from a sub- application in a different security domain, you will encounter security errors at run-time. In addition, you cannot access the application through the SWFLoader.content object. For details about the architecture of a sandboxed application, see "About sandboxed applications" on page 5. Pop-up controls in sandboxed applications Pop-up controls are parented by the application at the sandbox root of their security domain. This is because the sandbox root handles requests to display a modal window from its children. Because pop-up controls are parented by the sandbox root, centering a popup in a sandboxed application centers it in the area of the screen occupied by the sub-application and not the entire application. It also means that pop-up controls are sometimes clipped by scroll bars and masks on the sub-application. A sub-application in a separate security domain from the main application has the following behavior: · Launching a modal dialog box dims the entire application, but the pop-up can only be dragged within the boundaries of the sub-application. · Centering a pop-up centers it over the sub-application, not the main application. · Dragging pop-up controls works over the sub-application only. If you drag a pop-up outside the sub-application, it is clipped. · Focus shifts to the pop-up control when you first launch a pop-up. A sandboxed application cannot display a window or dialog box outside the bounds of its application. This rule prevents an untrusted application from phishing for passwords by displaying a dialog box on top of all the applications. When displaying a popup window, the PopUpManager checks if the parent application trusts it and if it trusts the parent application before asking the parent to host the window. If the parent hosts a window it is displayed over the parent's content as well as the child's content. If no mutual trust exists between a main and sub-application, then the PopUpManager hosts the dialog box locally so that it can only be displayed over the content of the application itself. But if the parent trusts the child, the dialog box is not clipped by the boundaries of the child's application. When a main application does not trust a sub-application, the main application's SWFLoader uses masking with a scrollRect and scroll bars to keep the sandboxed application's content restricted to its own application space. Pop-up-related controls such as ColorPicker, ComboBox, DateField, PopUpButton, PopUpMenuButton, and Menu sometimes display their contents in unexpected ways if their normal position would cause them to be clipped. Alert controls in sandboxed applications Alerts, like other pop-up controls in sandboxed applications, are clipped at the edge of the loaded application. When an Alert is being displayed, the main application and all sub-applications are covered with a modal dialog box to prevent interaction with their controls. The blur effect only applies to the sub-application that launched the Alert box, and its child applications. The blur effect is not applied to the parent application or sibling applications.