0

It would be nice if sites like Medium or Substack allowed users to not only add text, images, code snippets, etc., but also custom scripts that allowed readers to run a little piece of code. For example, if someone was writing an article on how to create a unique react element, they could have the running code in the article, with interactive UI elements. Or perhaps adding a custom form to fill out.

What are the risks of allowing users to add arbitrary Javascript to hosted articles? Is it malicious code injection that’s the problem? Could a site like Medium guard against that somehow?

2
  • @mentallurg definitely related, although this question assumes service-side processing. For me, only client-side JS would be executable.
    – Cybernetic
    Mar 30 at 1:11
  • Stack Overflow does this by running the javascript in a sandboxed iframe
    – nobody
    Mar 31 at 8:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.