Security Fox of Flash SWF that had enabled Cross Site Scripting (XSS)

thepag · thepag · commit c5fe17bb4459 · 2013-04-12T15:59:53.000+01:00
diff --git a/actionscript/Jplayer.as b/actionscript/Jplayer.as
@@ -239,7 +239,7 @@ package {
 			}
 		}
 		private function illegalChar(s:String):Boolean {
-			var illegals:String = "' \" ( ) { } * + / \\ < > = document";
+			var illegals:String = "' \" ( ) { } * + / \\ < > = document alert";
 			if(Boolean(s)) { // Otherwise exception if parameter null.
 				for each (var illegal:String in illegals.split(' ')) {
 					if(s.indexOf(illegal) >= 0) {
diff --git a/actionscript/happyworm/jPlayer/JplayerStatus.as b/actionscript/happyworm/jPlayer/JplayerStatus.as
@@ -14,7 +14,7 @@
 package happyworm.jPlayer {
 	public class JplayerStatus {
 
-		public static const VERSION:String = "2.2.20"; // The version of the Flash jPlayer entity.
+		public static const VERSION:String = "2.2.23"; // The version of the Flash jPlayer entity.
 
 		public var volume:Number = 0.5; // Not affected by reset()
 		public var muted:Boolean = false; // Not affected by reset()
diff --git a/jquery.jplayer/Jplayer.swf b/jquery.jplayer/Jplayer.swf
diff --git a/jquery.jplayer/jquery.jplayer.js b/jquery.jplayer/jquery.jplayer.js
@@ -8,8 +8,8 @@
  *  - http://www.gnu.org/copyleft/gpl.html
  *
  * Author: Mark J Panaghiston
- * Version: 2.2.22
- * Date: 29th March 2013
+ * Version: 2.2.23
+ * Date: 12th April 2013
  */
 
 /* Code verified using http://www.jshint.com/ */
@@ -454,8 +454,8 @@
 	$.jPlayer.prototype = {
 		count: 0, // Static Variable: Change it via prototype.
 		version: { // Static Object
-			script: "2.2.22",
-			needFlash: "2.2.20",
+			script: "2.2.23",
+			needFlash: "2.2.23",
 			flash: "unknown"
 		},
 		options: { // Instanced in $.jPlayer() constructor

Original file line number	Diff line number	Diff line change
`@@ -239,7 +239,7 @@ package {`
`239`	`239`	`}`
`240`	`240`	`}`
`241`	`241`	`private function illegalChar(s:String):Boolean {`
`242`		`- var illegals:String = "' \" ( ) { } * + / \\ < > = document";`
	`242`	`+ var illegals:String = "' \" ( ) { } * + / \\ < > = document alert";`
`243`	`243`	`if(Boolean(s)) { // Otherwise exception if parameter null.`
`244`	`244`	`for each (var illegal:String in illegals.split(' ')) {`
`245`	`245`	`if(s.indexOf(illegal) >= 0) {`