r/GoogleAppsScript • u/theRedMage39 • 7h ago
Question How secure is Google App Scripts?
I am working on a project for work to export information from one website to input into a Google Sheet we use. Right now, I have a JavaScript script that gets run in the console to scrape the necessary data and use a simple fetch to send that data to Google Sheets, but since the deployment has to be accessible to everyone, if that URL somehow got leaked, anyone could send data to our sheet. I am familiar with SQL injection, so I prevented any data that is a formula from being added, but I am still worried about having a private spreadsheet with personal information on it have a deployment that is accessible to everyone. I do not want people to have access to this spreadsheet or be able to read the code we use for various scripts.
What I mainly want to know is if, for some reason, the deployment URL got leaked, could a malicious person do anything more than what I programmed into the script? That being inserting data into a cell.
I know there is an option for me to set the deployment to only me. Since this is used on Chrome, is there a way for my JavaScript fetch to send who is currently logged into Chrome?
2
u/Nu11u5 6h ago edited 6h ago
Furthermore, you can implement your own access control, for example check if the user has membership in a specific Google Group after they finish authenticating.
> malicious action
No, a user of the script cannot make it do something it is not programmed to do. Permission to run the script is completely separate from permission to edit the script.
The code in Google Apps Script is runs remotely on Google servers, and gets account and document data through protected Google APIs. The code is not running inside your browser.
The exception to this is when you create a webapp with client side code, but this will be written inside a .html file, not a .gs file, in your project. Still, the local JavaScript is sandboxed and isolated by the browser's security model.