20

Just wondering if there's a risk to a user's machine by clicking "Run Snippet" in questions like this one

I'm suspicious because on the face of it the question doesn't look like it needs to have "Run Snippet" functionality - the question would stand fine on its own as "I see this code; what is it [insert normal code block]"..

..but I'm not big enough into this kind of web dev to know whether this question should be flagged for delete/made safe. The code block looks incomplete but I don't know if that's significant..

9
  • 7
    The malicious script in that question is incomplete and contains a syntax error -- it won't do anything when run. Commented Mar 28, 2022 at 8:22
  • 1
    Hard to guess the real intention. It could be an honest question like that kind of questions in Security.SE and they just saw that Stack Snippet provided input for HTML+JavaScript conveniently. Stack Snippet itself is sandboxed and AFAIK, should not run directly on the user's device though.
    – Andrew T.
    Commented Mar 28, 2022 at 8:22
  • I took back the statement regarding dangerous script due to Add a warning about snippets being dangerous when they are run and I'm not well into web dev also.
    – Andrew T.
    Commented Mar 28, 2022 at 8:28
  • Yeah what can one say... this is the risk of having a "run" button. The people who decided that the run snippet button would be a good idea most definitely will have considered the security implications and tried to mitigate it as far as possible, but you will forever hit a button like that fully at your own risk. I would never hit run on vbscript code, even if I know it is sandboxed.
    – Gimby
    Commented Mar 28, 2022 at 10:02
  • 1
    Well... how can you even launch a local script or executable on someone's machine from a site inside a web browser?
    – Lundin
    Commented Mar 28, 2022 at 11:36
  • It's VBScript so won't run in modern browsers anyway, posting it as a stack snippet has no value.
    – user692942
    Commented Mar 28, 2022 at 15:51
  • 9
    A lot of users don't seem to get that the snippets are web-specific and won't work for just any language. I remove them from R posts (both questions and answers) pretty routinely. I wouldn't take an inappropriate snippet as a reason for suspicion
    – camille
    Commented Mar 28, 2022 at 21:04
  • 6
    @camille And of those that do seem to get that the stack snippets are web-specific (i.e Javascript) a lot still don't get it that they need to post code that can actually "compile" and run. I routinely edit these down to basic formatted code snippets.
    – Drew Reese
    Commented Mar 29, 2022 at 0:29
  • Many (new) users seem to "accidentally" use the "JavaScript/HTML/CSS snippet" tool when they simply want to past a "code sample".
    – MrWhite
    Commented Mar 30, 2022 at 12:13

1 Answer 1

43

At the moment, Stack Snippets are, to the best knowledge of experts who've considered the problem (both SE employees and standard users like ourselves), completely sandboxed and pretty safe to run. The only risk of pressing "Run code snippet" is to have the child window eat up your memory and/or CPU, which can be easily remedied by closing the window, but that's pretty minor - for active users, accidentally running a snippet that produces an infinite loop (either from the OP or while attempting to craft an answer) happens every once in a while but isn't a big deal at all.

(There was one minor security issue a while ago I'm aware of, but it was fixed. I would be pretty surprised if there were more - there is a very low surface area for exploitation, given how seriously modern browsers take sandboxing.)

I don't know much about VBScript in particular, but was only supported by Internet Explorer, and even IE disabled it some time ago, and IE itself is being forcibly retired in a few months. Even if VBScript were enabled and there weren't syntax errors and it was on a top-level window (and not a sandbox), browsers would not allow sites to just run potentially untrustworthy code like this.

Stack Snippets are safe. What's not safe is pasting unread or large amounts of code into something more privileged and outside the sandbox - such as into the browser console, or into Node, etc. This issue exists on pretty much all languages - it's not just a JavaScript thing, and is easily remedied with common sense precautions that our sort of question-answerers should be aware of. I have seen one or two questions by people who were probably attempting to trick Stack Overflow viewers into running malicious code, but it's quite rare.

the question doesn't look like it needs to have "Run Snippet" functionality - the question would stand fine on its own as "I see this code; what is it [insert normal code block]"..

This is a common problem - too many new (or uncaring) users don't understand that Stack Snippets are only for in-browser HTML/CSS/JS. It's not an indication of malicious intent, just a failure of the UI to communicate the purpose of snippets, and a failure of the users to proofread their question. Just move the code out of the snippet.

6
  • 7
    Is this really true? Couldn't someone use stack snippets to take advantage of emerging vulnerabilities such as the variation of Spectre-v2 published 3 weeks ago that is currently unpatched?
    – Pluto
    Commented Mar 28, 2022 at 17:24
  • 10
    @Pluto My rule of thumb: There will always be exploits to be exploited so no user code should be trusted until you verify it yourself. If after reviewing the code it looks okay, then I'll let it run. Commented Mar 28, 2022 at 21:11
  • 9
    The absolute "are safe" or "is safe" shouldn't be used it comes to security (or medical interventions of any kind, for that matter). Very serious vulnerabilities go undetected for (literally) decades. The systems are too complex and new problems may be introduced at any time. Even with formal proofs, there are side-channel attacks. Commented Mar 28, 2022 at 21:47
  • 1
    What about IP loggers? Either with a malicious fetch or a <script src="https://badactor.example.com"></script>? Commented Mar 30, 2022 at 3:45
  • @Samathingamajig What about those? And no, that's not worse than just linking that site directly from the post - following such a link is no different than running a snippet that loads a script from the site.
    – Bergi
    Commented Mar 30, 2022 at 15:04
  • 1
    @Samathingamajig You can already do that with image embeds (which unlike snippets are unconditionally and automatically loaded).
    – loops
    Commented Mar 30, 2022 at 16:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .