I'm creating a small playground for people to write and test out their JavaScript on my website. I know websites like jsfiddle already exist but it's just for fun and for the sake of trying something new.

Now I know people can hack my site pretty badly with XSS and other things so I came up with a few ways to prevent havoc:

  1. As usual, people write their JavaScript and HTML in a form. It's pure text. Nothing functional.

  2. When wanting to test out the code the data is sent from www.A.com to www.B.com

  3. On that domain, the data is written to an iframe with the sandbox feature on without the "allow-top-navigation" option.

  4. The iframe is then sent back to www.A.com

  5. www.A.com receives iframe and appends it as a child into the DOM.

  6. The user sees the iframe and can interact with it.

Is this secure enough? or am I missing something crucial?

  • Are users able to sign in or otherwise do anything meaningfully sensitive on www.A.com? If not, then honestly you don't really need a sandbox; XSS doesn't gain anybody any meaningful increase in privileges. Might still be a good idea to practice the sandboxing, but remember: not all sites actually care about XSS, etc. because it's an elevation of privilege attack, and on many sites, no user has any privileges that any other user doesn't. – CBHacking Jul 30 at 3:10
  • @CBHacking yes they can register, login and save their code. The code is stored in a database. Should I consider it in this case? – Asperger Jul 30 at 14:12

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.