All geek questions in one place

Reliably publish and then print JavaScript tags

I am trying to create a back-end application for checking ads in PHP. We have many places where you can show ads, and almost all of them have their own unique requirements (they are shown inside the games, so each one differs in size, weight, format, etc.). Since this can cause a lot of misunderstanding in different game campaigns (with agencies sending us ads with the wrong formats), we need to check each ad to make sure it works properly.

The application works great if our customers send us an ad file for review. But most of the time they send Adserver tags, so they can track the results, and those tags are usually javascript and iframe tags.

The problem is how to safely enable javascript and iframe code and display it on the page on the postback page (for visual verification) in all browsers without risking XSS issues?

At the moment, I managed to publish the code and print on the postback page in all browsers, but Chrome because of security measures. But since I still have to solve this problem, how can I get it to work in all browsers and still be sure that the application is safe?

Thanks. Decio

+4
source share
1 answer

If you include third-party javascript code, you always risk XSS. Say you are testing a code with an ad provider:

<script src="http://some3rdPartySite.com/script.js"></script>
  • Script can be modified to display and to get different results in the target domain and on all other pages. That is, you can see how he wants to show you, but you cannot be sure that it will be the same in some of your games.
  • An ad provider can change the script on this server at any time, possibly after your tests.

If you do not trust your ad sellers, I suggest that they choose an image + URL or iframe URL + sizes. You can do "bad things" with an iframe (for example, dragging frames by redirecting from your client page), but you should still be subject to cross-domain policies. This is not the case if you allow javascript code to be executed.

You can also provide your own analytics for ad sellers to meet their needs.

In any case, to test javascript results, you can use Selenium drivers with any browser: http://seleniumhq.org/ . This allows you to load any page, execute javascript code and get results. This way you can load your javascript code, find the DOM for the nodes and check their sizes, etc.

Alternatively, you can look at sahi: http://sahi.co.in/w/

0
source

Source: https://habr.com/ru/post/1403956/

More articles:


All Articles