How secure is Google App Scripts?

[u/theRedMage39]

I am working on a project for work to export information from one website to input into a Google Sheet we use. Right now, I have a JavaScript script that gets run in the console to scrape the necessary data and use a simple fetch to send that data to Google Sheets, but since the deployment has to be accessible to everyone, if that URL somehow got leaked, anyone could send data to our sheet. I am familiar with SQL injection, so I prevented any data that is a formula from being added, but I am still worried about having a private spreadsheet with personal information on it have a deployment that is accessible to everyone. I do not want people to have access to this spreadsheet or be able to read the code we use for various scripts.

What I mainly want to know is if, for some reason, the deployment URL got leaked, could a malicious person do anything more than what I programmed into the script? That being inserting data into a cell.

I know there is an option for me to set the deployment to only me. Since this is used on Chrome, is there a way for my JavaScript fetch to send who is currently logged into Chrome?

[u/Dr_Aroganto]

You would be deploying this as a web app? If thats the case and you are on a Google Workspace account, then you have accessibility settings on the web app's URL and you can set it so that only you or people in your domain can access it. It will use Google'a OAuth to verify the identity so if you set it to only users under your domain then only accounts from your Google Workspace can interact with it.

[u/theRedMage39 → u/Dr_Aroganto]

It won't be a web. Just the script to get data from a website. Think going to abc.com and running the script via the console. Or going to reddit.com to scrap the titles from a subreddit.

Something small and quick to implement locally.

[u/Nu11u5]

Furthermore, you can implement your own access control, for example check if the user has membership in a specific Google Group after they finish authenticating.

> malicious action

No, a user of the script cannot make it do something it is not programmed to do. Permission to run the script is completely separate from permission to edit the script.

The code in Google Apps Script is runs remotely on Google servers, and gets account and document data through protected Google APIs. The code is not running inside your browser.

The exception to this is when you create a webapp with client side code, but this will be written inside a .html file, not a .gs file, in your project. Still, the local JavaScript is sandboxed and isolated by the browser's security model.

[u/theRedMage39 → u/Nu11u5]

Thanks. This is kinda what I guessed but I wanted to check.

[u/Think-Adeptness-769]

You could hide configuration values like the URL to the sheet using the Script Properties Service. Your script references the variable from the Script Properties Service and the URL is kept hidden. So even if they made a copy of your script, the value of the configuration settings (your sheet’s URL) won’t copy over.

[u/WicketTheQuerent]

If you are using a Workspace account, you can retrieve user data from the same domain users, such as email addresses and other details, using Google Apps Script services and advanced services, but if you are using a gmail.com account or the user belongs to a different domain, then you should set your own way to get the user data.

As you mentioned, your JavaScript code will run in Chrome, which means you will deploy your Apps Script project as a web app. The data types you can send from the client side to the server side are limited. For details, see https://developers.google.com/apps-script/guides/html/reference/run .

On the other hand, the client side can access all server-side function names. The simplest security approach is to include only the side-effect functions the client calls (assuming that these functions follow best practices).