User entered Javascript security implications

Question

I'm creating a web site that lets people create their own site using a subdomain. Are there any security implications by letting people add custom javascript to their pages? If so, which ones? XSS? Cookie sniffing? Could I make it work by sanitising the html?

Right now I'm disallowing it, but it'd be great to let people decide for themselves. I've noticed Github hosted pages have user entered javascript on them.

possible duplicate of User entered Javascript security implications — , May 18 '13 at 12:23
@TerryChia - It's a duplicate no doubt about it, but this one is older and has one answer already from Stephen (probably from before it was migrated, Stephen is running for a moderator on Webmasters). I'm voting to close the other one and leaving this one open. ;) — TildalWave, May 18 '13 at 13:49
Also cross-posted and already answered here: http://stackoverflow.com/q/16623188/321790 — Xander, May 18 '13 at 14:21

score 6 · Accepted Answer · answered May 18 '13 at 19:04

The Same Origin Policy for DOM access isolates sub-domains, therefor the impact of XSS is isolated to a specific sub-domain. The Same Origin Policy for Cookie scope isolates sub-domains in that they cannot read or write another sub-domain's cookies. Just make sure your main site is www.site.com and no cookie is scoped to *.site.com, as this would be accessible (if it was an HTTPOnly cookie, it would not be accessible from JavaScript regardless of its scope).

Spot on! +1 for mentioning the issue with subdomains. – Adi May 18 '13 at 19:19 — Adi, May 18 '13 at 19:19

score 1 · Answer 2 · answered May 18 '13 at 12:22

1

Allowing user entered Javascript is pretty much the definition of Cross Site Scripting (XSS).

The story of the Samy Myspace Worm is a great illustration of what can happen when a user can upload Javascript onto your site. Myspace wanted to allow sanitized HTML, but the hacker found a way to get around it. He put some Javascript in that caused anybody who viewed his profile to "friend" him and post the javascript on their own profile.

answered May 18 '13 at 12:22

Stephen Ostermiller

483
1
5
13

2

Yes, but what if this JavaScript is on its own subdomain? You missed a vital part of this question. – rook May 18 '13 at 19:05

User entered Javascript security implications

2 Answers2