20

Firefox 32.0.2 with NoScript and AdBlockEdge.

Steps I have done to enable Stack Snippets:

  1. Allowed scripts from http?://stacksnippets.net
  2. In NoScript settings, went to XSS tab and added exceptions for http://stacksnippets.net and https://stacksnippets.net

Question: what are the assurances (organizational and technical) that the code in snippets won't conduct an XSS attack?

Are there any dangers in marking stacksnippets.net as an exception?

Please note that I do usually skim the snippet before running it.

16

To add to Matthew Herbst's answer, we also use HTML 5 sandboxed iframes allowing only scripts as a redundant security feature. Any browser that doesn't support sandboxing won't render Stack Snippets at all. Additionally, running the code on a different domain prevents the same-origin policy from being in effect, blocking all access to your user information on Stack Exchange sites. As for XSS - someone could try to write a Stack Snippet that XSS'd a third site, however form submission is disabled as well.

HTML 5 sandboxed iframes create the following restrictions on Stack Snippets code:

  • The framed document is loaded into a unique origin, which means that all same-origin checks will fail; unique origins match no other origins ever, not even themselves. Among other impacts, this means that the document has no access to data stored in any origin’s cookies or any other storage mechanisms (DOM storage, Indexed DB, etc.).
  • The framed document cannot create new windows or dialogs (via window.open or target="_blank", for instance).
  • Forms cannot be submitted.
  • Plugins will not load.
  • The framed document can only navigate itself, not its top-level parent. Setting window.top.location will throw an exception, and clicking on link with target="_top" will have no effect.
  • Pointer lock cannot be obtained.
  • The seamless attribute is ignored on iframes the framed document contains.

Read a bit more on sandboxed iframes here

  • 3
    Is it possible to lift the allow-same-origin restriction? An example stack snippet that requests JSON from another domain does not work in FF and IE (because the API a. requires referer header b. sends access control allow origin header). – Salman A Nov 29 '14 at 14:06
14

The assurance is that it is running as a different domain than the stack site you are on. This prevents it from having access to any resources assigned under the normal stack site domain. This is a fundamental concept of JavaScript. Of course, this all comes down to browser implementation so a security bug in say, Chrome, could open you up to XSS regardless of what others do.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .