How does jsFiddle allow and execute user-defined JavaScript without being dangerous?

Question

I've been working on a JS library and would like to setup a demo page on Github that allows, for example, users to define their own callbacks and execute commands.

I know "eval() is evil" and I can see how blind eval() of scripts could lead to XSS and other security issues. I'm trying to cook up some alternative schemes.

I really enjoy the interactivity of jsFiddle. I've taken a look at their source but was hoping someone could lay out here how jsFiddle allows and executes user-defined JavaScript without being dangerous. So long as it doesn't involve a 3rd party echo server, I'm hoping I can emulate the approach.

Leonardo Raele · Accepted Answer · 2025-07-02 20:07:00Z

29

jsFiddle executes user scripts on a separate domain. i.e. It loads an iframe containing a page that executes the JavaScript. The page in this iframe must be on a separate domain (in this case, http://fiddle.jshell.net) that has nothing that can be attacked (no cookies). (try it and see) Therefore, it can't interact with the parent frame and it can't steal cookies.

You can actually do this without a separate server by placing a static page in a separate domain that reads from its querystring in Javascript.
You can communicate back using the page title (and so can the enemy).

edited Jul 2 at 20:07

Leonardo Raele

2,8352 gold badges33 silver badges35 bronze badges

answered Nov 4, 2011 at 1:38

SLaks

891k182 gold badges1.9k silver badges2k bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

buley Over a year ago

What does it mean to execute on a separate domain -- load an iFrame containing a page that executes the JavaScript?

SLaks Over a year ago

@editor: Exactly. The page in the <iframe> must be on a separate domain that has nothing that can be attacked (no cookies)

Shlomi Hassid Over a year ago

@SLaks - Why does alert(document.cookie); works in jsFiddle?

Monarch Wadia Over a year ago

a bit late. @ShlomiHassid the security concerns revolve around access to cookies, NOT access to your browser environment. hence, alert('hello') works and outputs "hello" in an alert box, but alert(document.cookie) only outputs an empty string (the alert box does still show up, but doesn't show any cookies unless the jshell.net domain has cookies on it)

Collectives™ on Stack Overflow

How does jsFiddle allow and execute user-defined JavaScript without being dangerous?

1 Answer 1

4 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

4 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related