I'm planning a project which is to be PCI compliant, but I am stuck on a particular vulnerability and I can't think of a way to protect against it.
The kiosk would be firewalled and only allowed to load content from certain domains or IPs, but I'm worried about a user injecting code directly into the page.
What I'm imagining is that a person accessing the kiosk could inject code into the page using document.write() that would record user input, and then return to the kiosk later to gather the input.
At this point it seems like the only protection against this is that the user probably can't open a web console using only the keyboard. Are there either a) any way to prevent additional scripts to be loaded after a certain point? or b) any way to ensure that a web console can't be opened in a browser? Or some other protection?
In other words, besides physically securing the computer, what do I need to do to secure a browser-based kiosk application when the kiosk has a keyboard?
And ideas or thoughts are appreciated!