动态地将Google Analytics（分析）跟踪代码包含到asp.net页面中

Question

There is a request on a project which maps the following case:

The client can save Google Analytics tracking code using a page. This code then, is inserted at runtime into the master's page website dynamically.

The part of inserting the script into the master's page was an easy one. One thing that I'm struggling with is the requirement of creating a page where the user can past the Google Analytics javascript code and save it to a sql server table.

Not the page itself but the security concerns. If I let the user to input any javascript code, save it to a database, then this code is inject at runtime into the master's page, I believe there's a HUGE security breach right there.

My question is, how can I implement this with security but still let the freedom for the user to insert the script? Is there a way to check if the script inserted is a real google analytics and not some malicious script? I have done a lot of research but could not find anything usefull, so I believe SO is my last option.

Answer 1

I would think your best bet is to always keep the GA template, only allowing the "administrator" to pass in the GA account variables, and any code that would go in the "middle" - for example, event tracking code, etc.

That being said.. I understand your concerns.. and they are valid.. but how often will this code change? And since it's code, shouldn't it be tested prior to implementation? Perhaps the best methodology is to have any of these requests go through the development team, and source control, and QA, and then production release? In that regard, you can just "inject" this code from a local txt file, etc, so it's still somewhat plug and play, but with some source management around it...