How to safely embed any flash file (swf)?

Question

I want to allow my users to embed their own flash animations in their posts. Usually the actual file is hosted on some kind of free image hosting site. I would not load flash memory if the user did not press the button to play (so that nothing happens when the page loads). I know that people can do something really annoying shit in the flash, but I can’t find any information about the potential serious damage that the flash application could cause to the viewer.

Is it insecure to embed only any flash file from the Internet? If so, how can I allow users to embed innocent animations, but still not use malicious applications?

edit:

From what I can collect, the most obvious threat to actionscript is to redirect to a malicious site.

Adobe says you can set allowScriptAccess = never and allowNetworking = none and swf should not have any access to anything outside of itself. Will this solve all my problems?

Answer 1

Adobe , allowScriptAccess= allowNetworking= none, swf . allowNetworking Flash Player 9, Flash .

- SWF: HTML-

SWF- HTML

Answer 2

Flash . swf , XSS.

, hotlink, . Swf , , url .

- " " ( , ), /admin/deleteallpages.php, " . - , , , , cms ' .

​​ , , flash , .

Answer 3

SWF , SWF , .

:

var maskSpr : Sprite = new Sprite();
maskSpr.graphics.beginFill();
maskSpr.graphics.drawRect(0,0,safeWidth,safeHeight);
maskSpr.graphics.endFill();
myLdr.mask = maskSpr;

Answer 4

.

, allowScriptAccess = never allowNetworking = none, swf .

: allowNetworking Flash Player 9 ( myspace-), SWF Object, , - -.

, YouTube, allowNetworking "none". , - "", SWF .

, crossdomain.xml - .

, , :

http://www.adobe.com/devnet/flashplayer/articles/secure_swf_apps_04.html

http://blogs.adobe.com/stateofsecurity/2007/07/how_to_restrict_swf_content_fr_1.html

Answer 5

As an example, Drupal has a script on how to enable Flash content to users can be a security issue.

Answer 6

Yes, it is not safe.

There is no easy way to resolve this. You may have a whitelist of domains that YouTube, Hulu, etc. allowed, but the whitelist is essentially painstaking - you will be constantly updated.