0

I am making a store, where I want to allow the users to upload a custom html/js/css website to display with their product.

What security issues should I look for?

1 Answer 1

2

The two biggest issues surrounding DHTML are:

  • Script Injection
  • Cross-site scripting

CSS files are safe

.html and .js files are NOT safe. You can make .html files safe by insisting on your own Content-Security-Policy: shutting down inline scripts and styles, and only allowing them to use libraries that you've vetted. .js files need to be personally inspected to ensure that they are safe.

My advice is that instead of letting them update the html and js files, it would be safer to provide a template that they could file out online, and whose content you could store in a database.

1
  • Thank you for your answer, I was thinking about, that and will probably do it that way
    – Marton
    Commented Jun 17, 2020 at 16:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.