# What are the possible security breaches in CDF content?

It has been noted on this site before that the free CDF player is notoriously trigger-happy in declaring dynamic content to be "potentially unsafe", and forcing the user to enable dynamic content manually upon opening the CDF. This proceeds through a rather unfriendly banner and a big grey box that covers the content.

This file contains potentially unsafe dynamic content. More details $\gg$ Enable Dynamics

To quote István Zachar's answer on his canonical CDF question, just about anything will trigger this warning:

The security issue rises when a function is involved in the dynamic output:

• with definitions
• that changes attributes
• with options
• package related functions
• ToExpression/MakeExpression
• Compress/Uncompress

It seems to me that this trigger-happiness does not really serve the spirit of security protection: if everything causes the warning then it does not help to discriminate the truly potentially malicious files. Mostly, though, I'm puzzled as to what a file with that sort of content could do if allowed to roam free. I can understand that compressed content is a no-go, but what on Earth is wrong with a function with options?

So, to put this question more precisely:

• What sorts of malicious activity are these restrictions meant to prevent? How (roughly!) would they be achieved?

• More particularly, why is each of the features above a potential security risk?

• Conversely, what are the possible dangers of enabling dynamic content on a file I don't trust completely?

• How does this situation depend on whether one is running the free or Pro CDF Player, the web plugin, or full-blown Mathematica?

Edit: After posting this question, I was made aware of List of dangerous functions. This is similar, but many of the functions discussed there are disabled on CDFs, and particularly on the free player. Moreover, functions with definitions and with options are not deemed unsafe in notebooks, so the security thresholds for the two are different, and it is relevant to know what the dangers are in CDFs. What can those notebook-safe classes do in CDFs that renders them a security liability?

-
At least highly related: List of dangerous functions –  Kuba Feb 20 at 11:21
If you have Dynamic in your notebook/CDF you will get this warning whenever you open from a non trusted path - regardless of whether you use Mma or player pro or CDF. –  Mike Honeychurch Feb 20 at 12:50