Risks in allowing users to upload HTML/JS files

Question

We're designing an online aracade for HTML5 games. The users can upload a zip file which contains their game.

On upload, the zip is unpacked by the server and each file is looped checking it's extension against a white list allowing:

• .html
• .js
• .png
• .jpg
• .appcache
• .m4a
• .ogg

(Games must be made in our game editor which exports those files). This should prevent people uploading zips, server side script files etc etc.

The games are then moved onto our static cookieless domain (scirra.net). When the game is played on our scirra.com page the game is displayed in an iframe pointing to the scirra.net domain. This should prevent malicious JS from accessing scirra.com cookies.

Is this iframe technique and whitelist comprehensive enough to prevent anything malicious from being done? Note we can't really screen each JS file so we should assume people are going to try uploading malicious JS.

Answer 1

The origin inheritance rules for iframes will prevent the scirra.net iframe from interfering with scirra.com.

This however, does not prevent all attacks. In effect you are introducing a stored XSS vulnerability. XSS can be used to introduce browser based attacks, such as exploiting buffer overflows in ActiveX components. Exploiting falws in Flash, Adobe reader or Microsoft Office.

You should consider running an anti-virus on the scirra.net content. Although this won't prevent all attacks. The ifram'ed page could redirect or introduce another iframe that contains malicious content.

As Cheeksoft pointed out. Apps will be able to affect each other with XSS. A malcious app could gain access to another application offline storage or obtain other data embedded in another app. Forcing each app to have its on sub-domain will mitigate this issue. You could setup a DNS record to point *.scirra.net to your server and take care of the domain name within your web app.