Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm creating a web site that lets people create their own site using a subdomain. Are there any security implications by letting people add custom javascript to their pages? If so, which ones? XSS? Cookie sniffing? Could I make it work by sanitising the html?

Right now I'm disallowing it, but it'd be great to let people decide for themselves. I've noticed Github hosted pages have user entered javascript on them.

share|improve this question
    
possible duplicate of User entered Javascript security implications –  Terry Chia May 18 '13 at 12:23
1  
@TerryChia - It's a duplicate no doubt about it, but this one is older and has one answer already from Stephen (probably from before it was migrated, Stephen is running for a moderator on Webmasters). I'm voting to close the other one and leaving this one open. ;) –  TildalWave May 18 '13 at 13:49
3  
Also cross-posted and already answered here: stackoverflow.com/q/16623188/321790 –  Xander May 18 '13 at 14:21
add comment

migrated from webmasters.stackexchange.com May 18 '13 at 12:19

This question came from our site for pro webmasters.

2 Answers

up vote 6 down vote accepted

The Same Origin Policy for DOM access isolates sub-domains, therefor the impact of XSS is isolated to a specific sub-domain. The Same Origin Policy for Cookie scope isolates sub-domains in that they cannot read or write another sub-domain's cookies. Just make sure your main site is www.site.com and no cookie is scoped to *.site.com, as this would be accessible (if it was an HTTPOnly cookie, it would not be accessible from JavaScript regardless of its scope).

share|improve this answer
    
Spot on! +1 for mentioning the issue with subdomains. –  Adnan May 18 '13 at 19:19
add comment

Allowing user entered Javascript is pretty much the definition of Cross Site Scripting (XSS).

The story of the Samy Myspace Worm is a great illustration of what can happen when a user can upload Javascript onto your site. Myspace wanted to allow sanitized HTML, but the hacker found a way to get around it. He put some Javascript in that caused anybody who viewed his profile to "friend" him and post the javascript on their own profile.

share|improve this answer
2  
Yes, but what if this JavaScript is on its own subdomain? You missed a vital part of this question. –  Rook May 18 '13 at 19:05
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.