2 deleted 3 characters in body
source | link

Code is inherently dynamic and it is and will always be impossible to control the behavior of user-supplied code. By allowing users to execute JavaScript you are implementing a Cross-Site Scripting (XSS) vulnerability. XSS is also commonly used to expose users to Drive By Download attacks which is strangely missing from your threat model.

One way of mitigating the threat posed by XSS is to isolate user supplied scripts to a sub-domain such that they cannot access sensitive information due to the Same-Origin Policy. This does nothing for drive by download attacks, and it doesn't nothing to stop an attacker from executing BeEF on users of your web application or perform another type of drive by download attack.

Code is inherently dynamic and it is and will always be impossible to control the behavior of user-supplied code. By allowing users to execute JavaScript you are implementing a Cross-Site Scripting (XSS) vulnerability. XSS is also commonly used to expose users to Drive By Download attacks which is strangely missing from your threat model.

One way of mitigating the threat posed by XSS is to isolate user supplied scripts to a sub-domain such that they cannot access sensitive information due to the Same-Origin Policy. This does nothing for drive by download attacks, and it doesn't nothing to stop an attacker from executing BeEF on users of your web application.

Code is inherently dynamic and it is and will always be impossible to control the behavior of user-supplied code. By allowing users to execute JavaScript you are implementing a Cross-Site Scripting (XSS) vulnerability. XSS is also commonly used to expose users to Drive By Download attacks which is strangely missing from your threat model.

One way of mitigating the threat posed by XSS is to isolate user supplied scripts to a sub-domain such that they cannot access sensitive information due to the Same-Origin Policy. This does nothing to stop an attacker from executing BeEF on users of your web application or perform another type of drive by download attack.

1
source | link

Code is inherently dynamic and it is and will always be impossible to control the behavior of user-supplied code. By allowing users to execute JavaScript you are implementing a Cross-Site Scripting (XSS) vulnerability. XSS is also commonly used to expose users to Drive By Download attacks which is strangely missing from your threat model.

One way of mitigating the threat posed by XSS is to isolate user supplied scripts to a sub-domain such that they cannot access sensitive information due to the Same-Origin Policy. This does nothing for drive by download attacks, and it doesn't nothing to stop an attacker from executing BeEF on users of your web application.