I'm working on a web framework that makes surveys. It has an expression manager which lets admin users run code on the client as Javascript. There could be a potential XSS problem when there's more than one admin, as is the case for universities. So, instead of compiling expressions to Javascript, what about compiling them to a bitcode and have a tiny VM in the browser to check for XSS? Do you think it could give better protection than just analyzing Javascript?
2
-
So you are allowing users to add javascript that gets passed to other users & evaled?– user60812Commented Oct 14, 2015 at 14:15
-
@user60812 Yes, the framework allows admin users to add "expressions", compiled to Javascript, to be added to a survey or a question within a survey.– Olle HärstedtCommented Oct 14, 2015 at 14:24
Add a comment
|
1 Answer
Building your own "VM" could be a pretty heavy lift.
Just treat any code you didn't write as part of an external application. Execute the script off-page, ideally in a sandbox on the server. (Use a spidermonkey plugin or a node sandbox.) At the very least, execute untrusted scripts in a frame on a totally separate domain.
-
That depends, a small VM might not be such a big project. Here's one in Ruby in 150 LOC: github.com/txus/microvm Additional architectural dependencies is not an option because of the user-base. I will investigate the possibility to run scripts elsewhere, but it depends on how much they need to interact with other stuff. Commented Oct 14, 2015 at 14:59
-
@OlleHärstedt Not sure I understand the "additional architecture" comment. ... Is this an individually/locally deployed (on-premise) app?– svidgenCommented Oct 14, 2015 at 15:02
-
Both. It's an open-source PHP web-application, but you can buy support and hosting for it. Commented Oct 14, 2015 at 17:38
-
I can update my answer if it help; but, for on-premise applications that the customer customizes, it's perfectly acceptable to leave XSS concerns on their customizations in their hands. Bear in mind that many very expensive, very robust products are stable and secure out-of-the-box, but the customer is responsible for security issues that they introduce through their own processes, mismanagement, and customizations.– svidgenCommented Oct 14, 2015 at 18:01
-
Yeah, but the problem in this case arises in a certain setting, namely when there are more than one admin user. I think the framework should offer a possibility to handle this scenario safely. Thanks for your feedback! Commented Oct 14, 2015 at 20:08