Could browser javascript harm my backend server?

Question

Hi,

I'm coding an application where I want to let the user learn javascript in this way:

1. The user write javascript code on the browser like in an IDE.
2. The user saves it and the code will be saved as a string in my backend No-SQL database (MongoDB/CouchDB).
3. The user opens the application some days later and I pass that string to the web browser where the code will be executed with eval().

There will be only JSON data transferred between backend server and web browser. The server won't do anything on the code string, it will only save it directly into the database.

Could this code possibly do any damage on the server side?

Answer 1

No harm can come from this if its just stored as a string in the DB.

Its really no different than storing any other string. Its just data at that point.

Answer 2

anytime you accept input from a user you must check to make sure it doesn't contain things like sql injection or js injection.

So it can be dangerous to your server (sql injection could wipe/output your db) and to your users (js injection could send them to nefarious sites)

Answer 3

On the server-side, no. Unless the scripts runs on IE and create multiple files disk. Or make some request to your system inserting billions of new entries...

So you have to take care with requests (flood control), be careful with IE and be careful with SQL injections.

Examples

• Creating file in IE
• SQL Injection

And the request I'm talking about could be something like:

ajax.post("page_save_js.ext", "code=flood");

Then each time it runs it will insert a new code, flooding the server. StackOverflow controls this flood using captcha after some requests in a short amount of time.

Answer 4

Your server code won't run the javascript unless you tell it to somehow, so that won't cause problems. (And of course you should avoid any SQL injection issues.)

However, if you provide sensitive information in the page (hidden or otherwise), or allow javascript to make ajax calls into methods on your servier, those can be security issues.

Answer 5

Using a nosql database only makes you invulnerable against "SQL injection", but there are very similar QL injection attack vectors. So you still have to escape your data or use data safe APIs (the equivalent of prepared statements in the SQL world).

Some examples of NOSQL-injections are given on http://www.kalzumeus.com/2010/09/22/security-lessons-learned-from-the-diaspora-launch/ (Search for "NoSQL Doesn’t Mean No SQL Injection" within that page).

For the client side: If possible you should make sure that the java script is only delivered to the user who uploaded it unless the user is trusted. This includes a CSRF check on the login form. Wikipedia failed on this in the past.