允许用户上传指导画布动画的 Javascript 文件时应实施哪些安全限制？
我想建立一个网站，用户可以上传自己的画布动画供其他人查看。与此相关的安全风险是什么？有没有一种简单的方法来确保我得到的只是画布函数而不是恶意代码片段？想法？谢谢。
编辑：如果我将每个动画放在单独的子域中怎么办？有没有办法在用户上传时自动创建子域？
I want to make a site where users can upload their own canvas animations for others to see. What are the security risk implications associated with this? Is there an easy way to assure what I'm getting are only canvas functions and not malicious code snippets? Thoughts? Thank you.
EDIT: What if I put each animation in a separate subdomain? Is there a way to automate subdomain creation whenever a user uploads?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
就具体风险而言，最明显的风险是很容易造成持久的 XSS 威胁。这可以轻松地执行任何操作，从读取用户的 cookie（包括用于识别其经过身份验证的会话的 cookie）到重写页面或修改 CSS。
它还为 CSRF 打开了一扇非常容易的大门，这可能允许脚本代表受害者发布任意命令。另外，还存在点击劫持和标签点击等风险 - 可能的漏洞非常非常广泛！
有多种方法可以减轻这些威胁，但允许人们上传任意脚本这一事实本身就是一个巨大风险。
In terms of specific risks, the obvious one is the easy ability to create a persistent XSS threat. This could easily do anything from reading a users cookie's (including those used to identify their authenticated session) to rewriting the page or modifying the CSS.
It also opens a very easy door to CSRF which would potentially allow the script to post arbitrary commands on behalf of the victim. Plus there's the risk of things like clickjacking and tabnapping - the possible exploits are very extensive!
There are ways to mitigate these threats, but the very fact that you're allowing people to upload arbitrary scripts is a massive risk.
JavaScript 是一种非常灵活的语言，除非你对其进行非常深入的分析，否则几乎不可能确定实际代码正在执行什么。如果您允许上传 Javascript，您可以获得任何东西，并且您尝试使用的大多数保护都将不起作用。
在您的情况下，您可以做的是允许人们以某种自定义语言上传动画序列，您在上传后将其转换为 Javascript。这样您就可以更好地控制执行的内容。
Javascript is a language that is VERY flexible and it's nearly impossible to make sure what an actual code is executing unless you run very deep analyzis on it. If you allow Javascript to be uploaded, you can get anything and most of the protection you will try to use will not work.
In your case what you could do is allow people to upload the animation sequence in some custom language that you transform in Javascript after it's uploaded. That way you can have some better control over what is executed.