As asked in the title, I have been wondering this for a while. These sites allow the user to write scripts and store them too. Are they not vulnerable to attacks such as cross-site scripting or any other similar attack? If so how do they protect themselves and their clients.

For Example, somebody writes a malicious code and shares the code with others posing as someone who needs help. Now, Members of stack will of-course run the code to check what the problem is. Isn't that directly playing into the hands of the attacker?

  • Try alert(document.cookie) on jsfiddle: you'll see that the message is from “An embedded page at fiddle.jshell.net” (and is empty) Commented Nov 9, 2017 at 2:57
  • there's a lot of little things they can do, limiting iframes, checking referrers, etc, but there is no way to really stop everything. your example is not XSS, but it's completely possible. it's simply not feasible for these services to introspect all JS code under all obfuscations, etc, nor do they set out to.
    – dandavis
    Commented Nov 9, 2017 at 5:16

1 Answer 1


What you need to worry about here is XSS. Scripting in general is not (supposed to be) dangerous, since the browser limits what an attacker can do anyway. At least you can not do anything on JSFiddle that you can't do on any other webpage.

But what about the XSS? If you look at the source of JSFiddle you will find this:

<iframe sandbox="allow-forms allow-scripts allow-same-origin allow-modals allow-popups" allowfullscreen="" name="result" frameborder="0">

So the area where the code is executed is contained in an iframe. The URL of that page is https://fiddle.jshell.net/_display/. Since it is in a different domain from JSFiddle itself, it can not access any of the JSFiddle cookies. So that domain is pointless to XSS, because it contains nothing of value. It is just a page that returns any scripts you POST to it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .