Autoplaying flash movies
you can use html code to embed a video.
then you can add a &autoplay=1 parameter to the URI in the embed code to get that video to play automatically.
you can even hide your misdeed by reducing the video size to zero, although that doesn't protect you from code inspection.
and last but not least, you can embed all kinds of shit using code embedding ... google analytics even, just to find out who is gonna read your bloody post.
So the great question is how to stop this exploit without killing the cool embed fan video feature. Easy enough. Disable html embedding and create tags for allowed embeds.
So there, I spilled the beans. You can thank me for pointing you to a glaringly obvious security flaw. And now give me back my posting rights!
I'd quote the code but i think the code quoting feature doesn't escape the html code correcty, but here's anyway:
- <object width="480" height="295">
- <param name="movie" value="http://www.youtube.com/v/43p7JPqZkPg&hl=de&fs=1&hd=1&autoplay=1"></param><param name="allowFullScreen" value="true"></param>
- <param name="allowscriptaccess" value="always"></param>
- <embed src="http://www.youtube.com/v/43p7JPqZkPg&hl=de&fs=1&hd=1&autoplay=1" type="application/x-shockwave-flash" allowscriptaccess="always" allowfullscreen="true" width="480" height="295"></embed>
- </object>
wow, quoting works
