Security concerns with z3-js boxes
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 123
- Forks
- 34
- Avg merge
- 3h 48m
- Merged PRs (30d)
- 4
Description
Now that we eval every z3-js snippet, the door to potential security attacks is opened.
A possible scenario I could think of is that someone forks this repo, changes some z3-js content to be malicious, and hosts it on a public github page. Visitors of that page could have their information stolen through such malicious content.
Pretty sure the official docusaurus website has some mechanism against it as there are executable and editable JS blocks too.
TODO:
- look into sandboxing / sanity checks that the built-in editor might provide.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing where z3-js snippets are evaluated and investigate the sandboxing or sanity-check mechanisms used by the official Docusaurus website for executable, editable JavaScript blocks. Done means malicious content on a forked public page cannot access visitors' information.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- documentation, security
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100