Security on Web page that will allow user to add javascript dynamically

Question

I have implemented a requirement in my website where I can allow my end user to configure a link, to execute any javascript that he may require. Since, he can type in any javascript that he requires he also has the ability to open different web pages, create new pages via javascript, edit elements in the page via javascript and so on.

I have some security concerns over this functionality and would like to get some opinion from everyone. Is it possible that any malicious or unethical script could be added to the page that could bring about law and order problem or credibility issues? If so, is it possible to place in some code that would restrict the type of javascript that my user may add?

Who will see the link? Just the user who added the JS? Other members of the site? The general public? — Quentin
– Quentin, Commented Dec 3, 2011 at 9:21
@Quentin: Good point. I wrote my answer considering that JS will be publically visible (worst case). — Sergii Kudriavtsev
– Sergii Kudriavtsev, Commented Dec 3, 2011 at 9:24

evan · Accepted Answer · 2011-12-03 09:33:31Z

2

There's a thing called ADsafe which was developed for banner ads that is a strict subset of Javascript which is meant to prevent malicious code. I don't think you'd be able to do things like

open different web pages, create new pages via javascript, edit elements in the page via javascript and so on

though. I think you should re-think your needs, and try to determine if you can come up with a way to offer the ability for a user to choose from pre-determined code that you write, perhaps customizing it within certain bounds.

Then again, if you're absolutely sure that the javascript is only going to run for the user who entered it, there shouldn't be anything they can do that will screw it up for anyone else. If a user was determined he or she could simply inject their javascript in through other means, like a rewriting proxy or extension or simply the javascript console.

answered Dec 3, 2011 at 9:33

evan

4,3081 gold badge20 silver badges18 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Sergii Kudriavtsev Over a year ago

+1 for "re-think your needs". Handling arbitrary JS might be very complex.

Collectives™ on Stack Overflow

Security on Web page that will allow user to add javascript dynamically

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related