4

If you have say an HTML5 games arcade, that allows users to upload a script that runs a game with HTML5 and Javascript, assuming you have no filters on their input (apart from only allowing JS and HTML), what are the potential security risks and pitfalls?

One unlikely possibility is that if the games are popular, they could have a dormant ddos script inside them that can launch a ddos attack if the games are popular enough.

Stealing cookies is another, but if anyone has a comprehensive list, or any other ideas it would be interesting to hear them.

Marcel Korpel
  • 21,536
  • 6
  • 60
  • 80
Tom Gullen
  • 61,249
  • 84
  • 283
  • 456
  • Which users will run the scripts ? only the uploader or anybody? if anybody, they could for example listen key inputs and steal passwords. – BiAiB Feb 08 '11 at 10:52
  • The example I propose is that the games are uploaded to an online arcade, which anyone from the public can have a go on. The game could be part of a dynamic site with potential sensitive information as well. – Tom Gullen Feb 08 '11 at 10:56

4 Answers4

3

Allowing javascript to be uploaded an run opens up quite a lot of options for an attacker.

See Cross Site Scripting (wikipeda) and on OWASP.

In general - if you allow this, then an attacker can post any code, redirect users, exploit their browsers, install viruses and more.

Oded
  • 489,969
  • 99
  • 883
  • 1,009
2

Only my two cents..

One risk is when someone uploads a script that redirects the user to malicious website and that website is doing nasty stuff - user never intended to reach that website surely not via arcade game.

Shadow The GPT Wizard
  • 66,030
  • 26
  • 140
  • 208
2

Writing a bot that wins.
Then the game would quickly move to writing a better bot to beat the other bots ;)

If you load these scripts in an iframe with another domain, subdomain, port or protocol, the same origin policy will prevent these script to read the content of the main page.

And you can set a string communication between these iframe and your main page through window.postMessage for modern browser or using the window.name hack for older browsers.

And to prevent cookie stealing, you can have a secret key in your main page that you send back to your server for each request.

Mic
  • 24,812
  • 9
  • 57
  • 70
1

Check the links below which i found helpful for understanding the possibilities.

http://ejohn.org/blog/javascript-based-injection-attacks/

http://google-caja.googlecode.com/svn/changes/mikesamuel/string-interpolation-29-Jan-2008/trunk/src/js/com/google/caja/interp/index.html

Anil Namde
  • 6,452
  • 11
  • 63
  • 100