Malicious Code Examples/Snippets

Question

What is the best way to prevent introduction of malicious code when using snippets, skins, etc.?

Obviously this is less of a problem with sites like StackOverflow; however, how often have you run into Malicious Code Snippets? I don't just mean careless or wrong. I mean actively malicious. For example, I have used Wordpress a lot lately for local charity groups who need a quick site. I've noticed an increasing number of skins for WP that contain inappropriate scripts in them.

I'm interested knowing how widespread this is, and the most efficient ways for reviewing code to find hidden "features". In the case of something like a Wordpress skin, there can be quite a large amount of code in the background to be reviewed. Since the sites are for charity organizations, they are often not paying gigs, and I cannot afford to spend a huge amount of time poring over every plug-in/skin.

Answer 1

You have to. If you don't have time to review all of the code, you sure as heck don't have time to deal with the problems that can result from using it. It's that simple.

Answer 2

That's the case with free code snippets. If you use it in your product, I'd check it very carefully. If something would go wrong with the application nobody will listen to your "It's not my code. I wouldn't write something like this". You use this code, so for your clear conscience you have to check the code. I wouldn't give some piece of code to my client without checking it.

Answer 3

Either don't use them or make sure you understanding exactly what they're doing!