I'm working on a web framework that makes surveys. It has an expression manager which lets admin users run code on the client as Javascript. There could be a potential XSS problem when there's more than one admin, as is the case for universities. So, instead of compiling expressions to Javascript, what about compiling them to a bitcode and have a tiny VM in the browser to check for XSS? Do you think it could give better protection than just analyzing Javascript?

  • So you are allowing users to add javascript that gets passed to other users & evaled? – user60812 Oct 14 '15 at 14:15
  • @user60812 Yes, the framework allows admin users to add "expressions", compiled to Javascript, to be added to a survey or a question within a survey. – Olle Härstedt Oct 14 '15 at 14:24

Building your own "VM" could be a pretty heavy lift.

Just treat any code you didn't write as part of an external application. Execute the script off-page, ideally in a sandbox on the server. (Use a spidermonkey plugin or a node sandbox.) At the very least, execute untrusted scripts in a frame on a totally separate domain.

  • That depends, a small VM might not be such a big project. Here's one in Ruby in 150 LOC: github.com/txus/microvm Additional architectural dependencies is not an option because of the user-base. I will investigate the possibility to run scripts elsewhere, but it depends on how much they need to interact with other stuff. – Olle Härstedt Oct 14 '15 at 14:59
  • @OlleHärstedt Not sure I understand the "additional architecture" comment. ... Is this an individually/locally deployed (on-premise) app? – svidgen Oct 14 '15 at 15:02
  • Both. It's an open-source PHP web-application, but you can buy support and hosting for it. – Olle Härstedt Oct 14 '15 at 17:38
  • I can update my answer if it help; but, for on-premise applications that the customer customizes, it's perfectly acceptable to leave XSS concerns on their customizations in their hands. Bear in mind that many very expensive, very robust products are stable and secure out-of-the-box, but the customer is responsible for security issues that they introduce through their own processes, mismanagement, and customizations. – svidgen Oct 14 '15 at 18:01
  • Yeah, but the problem in this case arises in a certain setting, namely when there are more than one admin user. I think the framework should offer a possibility to handle this scenario safely. Thanks for your feedback! – Olle Härstedt Oct 14 '15 at 20:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.