Tell me more ×
Web Applications Stack Exchange is a question and answer site for power users of web applications. It's 100% free, no registration required.
up vote 5 down vote favorite

In forums, I see more and more questions that use jsfiddle or jsbin to share live examples.

My question: are these links safe? Would it be possible that somebody includes malicious code in a public jsfiddle or jsbin page?

share|improve this question
5  
JsFiddle is safe. We use a completely different domain for displaying the results so there's no same-domain privacy issues - you can't poke around with someone's cookies, etc. – Oskar Krawczyk Jan 22 '12 at 9:34

migrated from stackoverflow.com Jan 25 '12 at 8:41

3 Answers

up vote 2 down vote

Usually the risk is in being redirected to malicious code from server side. I don't think jsfiddle or jsbin have the capacity to harm as they are client side without there being malicious server side code that they are somehow perpetuating.

share|improve this answer
up vote 1 down vote

It is possible that someone may include code in a jsFiddle that is executed when you click the link. By using commonly known codes for crashing certain browsers they maybe able to crash your browser.

Someone could send you into popup hell or down a link path that is hard to escape or lock your browser with processor intensive operations.

In general these are very unlikely and will likely not cause an permanent damage to your machine.

share|improve this answer
up vote 0 down vote

Of course it is as possible to include malicious code there as in every other page. The JS is directly evaluated.

Add-ons like NoScript for Firefox can help here where you can for example temporarily enable JS for JSFiddle, permanently for SO and never for XYZ.

share|improve this answer
ok. The big difference is that on standard sites the scripts are under control of the site owner, that you can decide to trust or not. While places like jsfiddle or jsbin accept "collaborative scripting". – Christophe Jan 21 '12 at 19:36
@Christophe But would you know whether the site owner has malicious code in there? Maybe because of a security issue within his CMS? Thats what NoScript is for. – TimWolla Jan 21 '12 at 19:37
if I have a doubt, my choice is not to visit the pages. This is my current issue with jsfiddle. – Christophe Jan 21 '12 at 20:34
2  
@Christophe You should really try NoScript (If you are using firefox) then. You can temporarily enable JS for JSFiddle and Permanently for SO and never for XYZ. – TimWolla Jan 21 '12 at 20:40

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.