2

When I visit a site I built some time ago in IE, I get the message bar at the bottom of the browser pop up saying that the site wants to run Flash.

This is fine, except for the fact that there is no flash in the website whatsoever.

What could cause this? How could Flash now be in the site? Is this a security issue?

5
  • How do you know there's no flash on the webpage? From looking at it, or from viewing the source? Note that there are pages that use FlashPlayer for e.g. file upload or audio playback, in which case they may hide the player from view in various ways (e.g. 1x1 pixel size etc.).
    – JimmiTh
    Jan 31, 2012 at 11:09
  • 1
    I know there's no flash there because I built it! There are no upload controls or a/v players.
    – danwellman
    Jan 31, 2012 at 11:15
  • Sorry, missed that bit. Does it do the same on other PC's? Easiest, if possible, would be to let us see the website in question. Personally, in 10 years of Flash debugging, I've never heard of a false positive from IE - i.e. flash message without <object> code in the static HTML or injected (although it could of course be injected by something in the browser).
    – JimmiTh
    Jan 31, 2012 at 11:49
  • There are definitely no <object>s. Could a Chrome extension do it? Ah-ha! I don't get the message on other machines. Must be something to do with this machine...?
    – danwellman
    Jan 31, 2012 at 11:59
  • Nah, I do get a "This page requests an add-on that has been disabled" message. I'll have a look.
    – JimmiTh
    Jan 31, 2012 at 12:01

2 Answers 2

5

After looking at the page, it looks like it's triggered by Google Analytics attempting to instantiate FlashPlayer to check if it's installed and what version it is. Doing that is enough to cause IE to think it should inform you that the page is trying to use Flash.

Update

Sent it through the script debugger in Developer Tools, and sure enough, the moment the content of ga.js is executed, the message pops up.

For anyone interested, specifically, it's likely to be this bit of "beautified" code (can't tell for sure, because Developer Tools can't figure out the minified script):

if (!(b = Zc)) {
   var c, d, e;
   d = "ShockwaveFlash";
   if ((b = (b = U[va]) ? b.plugins : g) && 0 < b[u]) 
     for (c = 0; c < b[u] && !e; c++) 
        d = b[c], -1 < d[q][p]("Shockwave Flash") && (e = d.description[w]("Shockwave Flash ")[1]);
else {
   d = d + "." + d;
   try {
      c = new ActiveXObject(d + ".7"), e = c.GetVariable("$version")
   } catch (f) {}
   if (!e) try {
      c = new ActiveXObject(d + ".6"), 
      e = "WIN 6,0,21,0", 
      c.AllowScriptAccess = "always", 
      e = c.GetVariable("$version")
   } catch (l) {}
   if (!e) try {
      c = new ActiveXObject(d), e = c.GetVariable("$version")
   } catch (o) {}
   e && (e = e[w](" ")[1][w](","), e = e[0] + "." + e[1] + " r" + e[2])
}
b = e ? e : "-"

... which amounts to a pretty standard FlashPlayer version detection.

1
  • Excellent deduction, thanks :D least I know the site hasn't been hacked!
    – danwellman
    Jan 31, 2012 at 12:52
5

Google Analytics flash version detection could be turned off by adding the following to your GA code (before _trackPageview):

_gaq.push(['_setDetectFlash', false]);

This is what I did when faced with the same issue. I have no plans to use flash on my site so I do not need that kind of statistics.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.