We're designing an online aracade for HTML5 games. The users can upload a zip file which contains their game.
On upload, the zip is unpacked by the server and each file is looped checking it's extension against a white list allowing:
- .html
- .js
- .png
- .jpg
- .appcache
- .m4a
- .ogg
(Games must be made in our game editor which exports those files). This should prevent people uploading zips, server side script files etc etc.
The games are then moved onto our static cookieless domain (scirra.net). When the game is played on our scirra.com page the game is displayed in an iframe pointing to the scirra.net domain. This should prevent malicious JS from accessing scirra.com cookies.
Is this iframe technique and whitelist comprehensive enough to prevent anything malicious from being done? Note we can't really screen each JS file so we should assume people are going to try uploading malicious JS.