3

I'm working on an Interactive Fiction story in Undum, which is a fully client-side JS/HTML5 framework. I've been reading about Content Security Policy lately (after looking up what a crypto nonce is) and began to wonder if any such thing would be important for code that's entirely client-side. I'd apply some basic CSP if I could, mainly the ban on inline code exec, but it looks like that can only be specified in an HTTP header which I don't control in this case (I think -- there's no transfer happening in my game, but github pages hosts the HTML and JS so HTTP is in use and is presumably controlled by github)

This question addresses a similar concern, but is a simpler context since it will be running locally on that OP's machine. My context will be as follows:

  • Where is the HTML and JS hosted: my github pages account. It's not actually up there yet, but a different one implemented in Inform 6 and run on a JS Inform interpreter (Quixe) is here and I don't see an obvious CSP in the HTTP headers
  • Where do dependencies come from: local JS files, jquery and undum library only
  • What operations are involved: clicking generated links within the page, generating/rendering HTML from local JS (no arbitrary text user input), writing to/reading from HTML5 window.localStorage object if available to support game save/load
  • Protocol: HTTPS

What security concerns might be relevant to a kinda sorta web app like this? There's no sensitive data involved; I'm mostly concerned with any sort of malicious script injection that might be possible.

Improve this question
1
  • 2
    If you are displaying any user generated content, then you need to be careful. (This is unlikely, as you're hosting it on Github, you don't mention any sort of database, and it's all client side.) Otherwise, have fun. The users can modify the code all they want, of course, but if there's no way for them to use your system to share that, there's nothing malicious that they can do to other players. (They can be malicious to themselves, of course... but they don't need your game for that.)
    – Ghedipunk
    Jan 6, 2020 at 22:18

1 Answer 1

Reset to default
2

When you say that the JS and HTML is hosted on GitHub, I am assuming you mean that the code is hosted there for download only and that your interactive story does not reach out to GitHub while running to fetch assets. If this were the case, then this external connection to GitHub could potentially be used for malicious actions. If someone can gain access to the code hosted on GitHub they can change it to run whatever they want on clients. This isn't necessarily injection, but it's worth bringing attention to.

However, it seems your app is not fetching code from GitHub while running. If this app this truly is only using local resources on the machine (no data fetching from elsewhere, no external links, etc) then your app should be safe from an external attacker. You should always be wary of displaying any user content, as this could potentially open the door to injection attacks if not properly sanitized, however in this case it seems the clients have no way of contacting other clients or uploading to a server. So realistically if a user could inject code into their client, the only person they could affect is themselves.

Another thing to be aware of: If you are building a framework in which users can create stories to distribute (for example allowing other people to play a story I create), this is also a vector of attack. This is because ultimately the story files are created by arbitrary users (like me) and are later interpreted by the client web app of the users who import them (Alice/Bob).

Improve this answer
6
  • GitHub pages is a hosting solution they provide that allows you to provide hosting of static pages whose source is hosted on GitHub.
    – Conor Mancone
    Jan 7, 2020 at 0:11
  • pages.github.com
    – Conor Mancone
    Jan 7, 2020 at 0:13
  • 1
    Yes, I've used GitHub pages I know how it works. The OP said that they are retrieving HTML and JS files from GitHub though, and if that is the case and an attacker gains control of the GitHub, they can supply their own JS to send to the client.
    – ExecutionByFork
    Jan 7, 2020 at 0:24
  • it's all within my own public repo on GitHub, github.com/mysterymagination/adventures-of-mooty-wort so while my pages account will be fetching code hosted on GitHub (once I add an index.html to the repo), it's code I control (write) access to so I think it should be safe from the remote resources vector you mentioned
    – CCJ
    Jan 7, 2020 at 23:55
  • 1
    If you decide to load external resources while your game is running (not just on install) then your desktop application has now become a web application, and you should take all the normal precautions that revolve around web apps which ingest external data. Sanitize data appropriately to avoid injection attacks, store the data properly, be especially careful if you are interpreting that data as instructions or allowing it to alter your program's control flow, etc.
    – ExecutionByFork
    Jan 8, 2020 at 15:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .