Preventing Hijacking with QTSRC and OBJECT

F15 Wall of Fire


The HTML for using QTSRC in the EMBED tag, wrapped in an OBJECT tag, looks like this:

<OBJECT CLASSID="clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B"
        CODEBASE="http://www.apple.com/qtactivex/qtplugin.cab"
        WIDTH="320" HEIGHT="256" >

        <PARAM NAME="src" VALUE="F15_320.mov" >
        <PARAM NAME="autoplay" VALUE="true" >
        <PARAM NAME="volume" VALUE="50" >

        <embed src="UNeedQT.pntg" type="image/x-macpaint"
           qtsrc="F15_320.mov" width="320" height="256" autoplay="true" volume="50">
        </embed>
</OBJECT>

Notice that the QTSRC and TYPE parameters appear only in EMBED tag, not as PARAMs for the OBJECT.

Notice also that the EMBED tag's QTSRC and the OBJECT's SRC point to the same file.