0

I am working on a new SharePoint online tenant, and one of the requirements is to have a modern web part that is similar to the popular on-premises/classic Script Editor web part.

so i found this SPfx web part @ https://github.com/pnp/sp-dev-fx-webparts/tree/main/samples/react-script-editor, which mimic the on-premises/classic Script Editor web part.

but i have these questions about this web part:-

  1. Is it unsafe to have this web part inside the online SharePoint sites? In our case some sites have all users are contributors, so all users can create modern pages and hence add this react-script-editor web part to the modern pages they create.

  2. If the answer to question-1 is Yes (using this web part is unsafe), then what can users do with this web part? or what are the risks we will be exposed to? For example can a user write a script inside this web part which get the users' passwords and save them to external system ??

  3. If it is unsafe to use the react-script-editor web part out of the box, then are there any steps we can take to minimize the risks that this web part can cause?

Thanks

Improve this question

1 Answer 1

Reset to default
1

  1. Allowing scripting opens the doors to potentially malicious activities, so yes, it is not all that safe.

  2. I doubt than any script is able to get another user's password. The authentication has already happened when the SharePoint page is loaded, and no modern system will simple disclose a password.

  3. You could deploy the script editor web part only to the specific sites that need it, instead of deploying it for the whole tenant. You can also work with permissions, so only trusted people are allowed to edit pages in the site pages library. Combine that with a multi-person review, so that page changes must be approved by a supervisor before they can be published.

If you need a wider group of people to generate and edit site pages, let them do that on a different site that doesn't have the scripting web part deployed. You can use standard SharePoint techniques to surface pages from one site on the news web part of another site, e.g. by linking to a hub site. It's just configuration.

Improve this answer
2
  • thanks for the reply... but you did not mention what kind of malicious activities the users can do if they are allowed to inject custom javascripts inside the modern pages?
    – John John
    Commented Nov 12, 2021 at 6:19
  • I can't. I don't have a malicious intent and I am not interested in exploring what malicious activities could be possible. The possibilities are manifold. Use your own scenarios.
    – teylyn
    Commented Nov 14, 2021 at 1:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.