Flex calls JavaScript code

<?xml version= "1.0" encoding= "Utf-8"?> <s:application xmlns:fx= "http://ns.adobe.com/mxml/2009" xmlns:s= "Li Brary://ns.adobe.com/flex/spark "xmlns:mx=" library://ns.adobe.com/flex/mx "minwidth=" 955 "minHeight=" "Creation" Complete= "Init (event)" > <fx:Script> <!
			[cdata[import Mx.controls.Alert;
			Import mx.events.FlexEvent;
			Import mx.messaging.events.MessageAckEvent;
			Import mx.messaging.events.MessageEvent;
			Import mx.messaging.events.MessageFaultEvent;
			Import Mx.messaging.messages.AsyncMessage;
			
			Import Mx.messaging.messages.IMessage; /** * The following code inserts a JS method backwards into the browser to listen for browser shutdown events */protected function init (event:flexevent): void {//general if you see this in the Flash code
				
				function, and the parameters inside can be the user can control, there will be XSS risk,//My Flash security Scanning Tool scanning principle is the same, encountered this function and Geturl, if the parameters from the outside of the word is considered a loophole.	Externalinterface.call (Function_userexit);
			
			Flash's Externalinterface.call () calls the external JS function externalinterface.addcallback ("Checkexit", checkexit); }/** * MonitoringBrowser Shutdown Event Function * * */private static var function_userexit:string= "Document.insertscript = function ()" + "{" + "W
				Indow.onbeforeunload = function () "+" {"+" var flexobj = Flex_chat.checkexit (); "
				+ "If" (Flexobj!= \ "\") "+" {"+" return flexobj; "
				+ "}else{" + "return;"
			
			+ "} "
				+ "} " 
				+ "} "; /** * Exit */Public Function checkexit (): String {var userexitstr:string= "See you next time."
				";
			return userexitstr; ]]> </fx:Script> <fx:Declarations> <!--place non-visual elements (such as services, value objects) here--> </fx:declarations&gt
	
	;
 <s:button label= "Send" click= "alert.show (' so sth ')"/> </s:Application>