Security Issues for allowing users to add own JavaScript to your site? -

i planning create open source education web app people can add , edit content (a bit wikipedia).

however wish add feature allows user add own interactive content using javascript. (similar how jsfiddle it)

what security concerns in doing this? optional question: how can these issues overcome?

yes use html5 sandbox load user scripts in iframe.

you should host user content different domain main site. prevent xss attack if attacker convinces user visit page directly (outside of sandbox). e.g. if site www.example.com use following code display sandboxed iframe:

<iframe src="https://www.foo.com/show_user_script.aspx?id=123" sandbox="allow-scripts"></iframe> 

this allow scripts, forms , navigation outside of iframe prevented.

the html5 security cheat sheet guidance on owasp states purpose of sandbox:

use sandbox attribute of iframe untrusted content

you should test whether sandbox supported first, before rendering iframe:

<iframe src="/blank.htm" sandbox="allow-scripts" id="foo"></iframe> 

var sandboxsupported = "sandbox" in document.createelement("iframe");  if (sandboxsupported) {     document.getelementbyid('foo').setattribute('src', 'https://www.foo.com/show_user_script.aspx?id=123'); } else {     // not safe display iframe } 

it safer way dynamically changing src rather redirecting away if sandboxsupported false because iframe not accidentally rendered if redirect doesn't happen in time.

as @snowburnt touches upon, there nothing stopping user script redirecting user site drive-by download occurs, approach, assuming user date on patches, , there no zero day vulnerabilities, safe approach because protects end users , data on site via same origin policy.