Verify javascript code at server

Question

I have a text area in my web where user can add java script code. I need to check if this code contains any malicious code or not. What are the options at

1. Client end
2. Server end

Or where can I find a good material for checking for malicious code.

Answer 1

There is a reason that webmail sites (e.g. gmail) strip all Javascript when rendering HTML messages, and that is because it is simply far too difficult (if not impossible) to verify if any code is malicious (especially when executed in the context as coming from your domain, and thus opening a host of XSS issues).

If you really need Javascript support you can maybe whitelist a handful of supported functions while stripping everything else, but even this route is fraught with peril.

If security is important, you should strongly consider if Javascript is really necessary or not. A workaround may be to provide your own interpreted language or set of functions that you translate to Javascript for the user when the HTML is created (to me, this is the only safe option).