Archives for February, 2007

Hi5 HTML filtering stupidity


Hi5, another social networking site, filters HTML code oddly.
Embeds are allowed (I don’t think they used to be), but if there are any percent signs (%) in the embed’s attributes, it doesn’t display. Further testing reveals that hi5 seems to strip out any tag that has attributes that contain any URL-encoded entities in it at [...]

Flash Player security misunderstanding


Up until now, I had been making some incorrect assumptions about Adobe Flash Player’s security model.
I had assumed that a SWF could not access anything outside of the domain from which it had been served, in general, without special allowances made by things like crossdomain.xml or System.security.allowDomain().
What I didn’t realize is that these domain restrictions [...]