Dealing with malicious js in html5 banners [closed]

Question

My company wants to implement functionality, allowing the clients to upload html5 banners in out ad serving system.

I suggested that there might be issues with "malicious" javascripts in the uploaded files (in AdWords, for example, you upload a zip file, containing all the resources - css, js, html, images).

Does anyone have any idea how can we "cut" those malicious scripts (for example, cookie-stealing) ? One way is to hire a guy, who has to inspect every single upload, but that's too much work. Other suggestions are welcomed :)

Answer 1

Put the banner ads into an <iframe> and use the sandbox property of the iframe to limit its rights. But keep in mind that the sandbox property is not supported by Internet Explorer 9 and earlier, so these users will not be protected.

Also load your 3rd party content from a different subdomain than your own content. That way they don't get access to the cookies and localstorage of the main website (however, they do get access to any cookies set by other advertisers, unless you configure a different subdomain for every advertiser).

But you won't be able to remove any dangers for your visitors when you allow 3rd party scripted content unsupervised. Vulnerabilities in web browsers which can be exploited through seemingly harmless JS or plugin content are a striving market and black hats are very interested in smuggling these exploits into advertising networks, because it allows them to hit a large number of user machines with minimal effort. As a full-fledged programming language, JavaScript is far too complex to be filtered automatically for malicious behavior. What you are trying is dangerous!