Question

I’m working on creating one of those robot games. The user creates a robot and then puts it in a battlefield with other robots.

I’d like to let the users use javascript to program their bots. I’ll provide a number of functions for them to call, but they also can build thier own. (sorta)

To date, the only solution I have come up with is to use the javascript eval() function to execute the code the users have written.

I want to know two things:

1. Anyone have any alternative suggested implementations that still allow the users to write in javascript?

2. Can the users do anything with this flaw that they could not do using the firefox javascript debugging tools? (ie: on their own without my use of the eval() function)

Note: The javascript code is stored within mySQL. ajax is used to pull the jscript out and display to users. ajax is used to send javascript updates back into SQL. All code submitted by users and about to be inserted in the database is run through a “clean()” function.

Answer 1

So basically you will allow UserA to write javascript which will be evalled in UserB’s browser?

If so, then that sounds like a fairly bad idea 😉

You could use a middle layer such as http://code.google.com/p/google-caja/wiki/CajaCajole to make it a bit safer.

An example of what they could do is: write javascript which will present what looks like your login page, then send the username and password to another server.

Another example would be to inject a script tag which then gets the ‘full’ payload which could get up to all kinds of mischief, like fx showing a friendly popup with the new exclusive downloadable Portal game that you got a special deal with Steam to make available etc etc. Just download and Run! Then it creates a hidden iframe to some trojan cdn. 🙂