Baidu video flash cross-site and repair

Baidu video uses a flash directly to call the js function, but the filtering is not strict, resulting in a cross-site vulnerability. The test URL is:Http://list.video.baidu.com/r/video/static/swf/amuse_index.swf? FuncGetData = alert (document. cookie).

Details:

Private function readParmas ()
1548 {
1549 var loc0: * = null;
1550 var loc1: * = null;
1551 loc0 = loaderInfo. parameters;
1552 if (loc0.hasOwnProperty ("funcGetData "))
1553 {
1554This. FuncGetData = loc0 ["funcGetData"];
1555}
1556 else
1557 {
1558 this. FuncGetData = "getData ";
1559}
1560 loc1 = new Fade ();
1561 loc1.duration = 500;
1562 loc1.startAlpha = 0.4;
1563 addSwap (loc1 );
1564 return;
1565
1566}
1567 private function readDataNow ()
1568 {
1569 var loc0: * = null;
1570 var loc1: * = null;
1571 var loc2: * = 0;
1572Loc0 = ExternalInterface. call (this. FuncGetData );

Solution:

Strictly Filter