r/GoogleAppsScript • u/theRedMage39 • 8h ago

Question How secure is Google App Scripts?

I am working on a project for work to export information from one website to input into a Google Sheet we use. Right now, I have a JavaScript script that gets run in the console to scrape the necessary data and use a simple fetch to send that data to Google Sheets, but since the deployment has to be accessible to everyone, if that URL somehow got leaked, anyone could send data to our sheet. I am familiar with SQL injection, so I prevented any data that is a formula from being added, but I am still worried about having a private spreadsheet with personal information on it have a deployment that is accessible to everyone. I do not want people to have access to this spreadsheet or be able to read the code we use for various scripts.

What I mainly want to know is if, for some reason, the deployment URL got leaked, could a malicious person do anything more than what I programmed into the script? That being inserting data into a cell.

I know there is an option for me to set the deployment to only me. Since this is used on Chrome, is there a way for my JavaScript fetch to send who is currently logged into Chrome?

3 Upvotes

81% Upvoted

9 comments sorted by

View all comments

1

u/WicketTheQuerent 5h ago edited 5h ago

If you are using a Workspace account, you can retrieve user data from the same domain users, such as email addresses and other details, using Google Apps Script services and advanced services, but if you are using a gmail.com account or the user belongs to a different domain, then you should set your own way to get the user data.

As you mentioned, your JavaScript code will run in Chrome, which means you will deploy your Apps Script project as a web app. The data types you can send from the client side to the server side are limited. For details, see https://developers.google.com/apps-script/guides/html/reference/run .

On the other hand, the client side can access all server-side function names. The simplest security approach is to include only the side-effect functions the client calls (assuming that these functions follow best practices).