From: Mongoose Sir mongoose <mongoosehq@...>
Date: 2009-08-16T10:35:37+09:00
Subject: Parsing JavaScript to prevent maliciousness?

Hello,

I'm working on a site that is implementing similar functionality to _A
Certain Large Social Networking Site_'s Apps feature.

Application developers will be able to write apps in a hybrid HTML /
"FooML" / JavaScript syntax.

This will get parsed by my servers (as the man in the middle) and then
shoved back to the user's browser as HTML.

Now, my normal inclination is just to dive in and start coding away =)

But I figured one of the smart people here might have some good pointers
on where to start.

The tricky problems, as I see them:

* Allowing access to some JavaScript functionality while stripping out
malicious calls (document.cookies ?)
* Also: how to deal with Base64 / eval / other tomfoolery that attackers
might attempt
* Parsing custom tags like <foo:username />, <foo:friend_list count="4"
/>.

The last one seems similar enough to parsing HTML trees so hopefully
there's something in ruby-land that can help with this)

Any suggestions / links / pointers would be greatly appreciated!!

- Sean

ps. if anyone is interested in working with me on some kind of open
source library that could handle this kind of thing in a
website/domain-agnostic way, feel free to hit me up.
-- 
Posted via http://www.ruby-forum.com/.