What are the risks of letting users upload and run Javascript

Question

If you have say an HTML5 games arcade, that allows users to upload a script that runs a game with HTML5 and Javascript, assuming you have no filters on their input (apart fr

Answer 1

Only my two cents..

One risk is when someone uploads a script that redirects the user to malicious website and that website is doing nasty stuff - user never intended to reach that website surely not via arcade game.

Answer 2

Allowing javascript to be uploaded an run opens up quite a lot of options for an attacker.

See Cross Site Scripting (wikipeda) and on OWASP.

In general - if you allow this, then an attacker can post any code, redirect users, exploit their browsers, install viruses and more.

Answer 3

Writing a bot that wins.
Then the game would quickly move to writing a better bot to beat the other bots ;)

If you load these scripts in an iframe with another domain, subdomain, port or protocol, the same origin policy will prevent these script to read the content of the main page.

And you can set a string communication between these iframe and your main page through window.postMessage for modern browser or using the window.name hack for older browsers.

And to prevent cookie stealing, you can have a secret key in your main page that you send back to your server for each request.

Answer 4

Check the links below which i found helpful for understanding the possibilities.

http://ejohn.org/blog/javascript-based-injection-attacks/

http://google-caja.googlecode.com/svn/changes/mikesamuel/string-interpolation-29-Jan-2008/trunk/src/js/com/google/caja/interp/index.html