What you're describing is just XSS.
Alice and Bob both use
example.com. Untrusted script is added by Alice into her profile page, and executed by Bob's browser upon visiting Alice's profile.
It doesn't matter whether
example.com intendes to allow Alice to inject arbitrary script into Bob's page view, or if Alice discovers an XSS that allows her to do so, the result is identical, it's a simple stored XSS.
Don't do this, unless each site runs on its own origin (ie
bob.example.com) and Same Origin Policy prevents profiles from attacking each other.
Lots of sites do do this, for example Shopify, but every shop runs on a user-specified domain or subdomain.
Enumerating every type of thing an XSS can do is probably outside the scope of this site. Yes, the obvious things like request forgeries apply, but there is an ever-growing list of features that browsers support. If Alice tries to attack these features, they often require permission, but
example.com may have already prompted Bob for permission for legitimate reasons, giving Alice free rein.
- Is there a big blob of sensitive data stored in localstorage that Alice can steal from Bob via her profile JS?
- Has Bob authorized
example.com to use his webcam to take a profile photo? Maybe Alice can activate the webcam and surreptitiously record Bob.
- Has Bob allowed
example.com to use notifications? Alice can spam Bob with bogus notifications
- Has Bob allowed the
example.com to read his device's GPS? Alice knows where Bob lives.
The list is as long as the list of available browser features that
example.com my have tried to make legitimate use out of.