Is this block safe from code injection exploit?

Question

Thanks good people here, I have create a simple module which generate two blocks as follows:

function myblockmodule_block_info(){
    $block['myadblocks'] = array(
        'info' => t('My first ad blcoks'),
        'cache' =>  DRUPAL_CACHE_GLOBAL,
    );

    $block['myadblocks2'] = array(
        'info' => t('My second ad blcoks'),
        'cache' =>  DRUPAL_CACHE_GLOBAL,
    );
    return $block;
}

/**
 * Define what our block is going to look like.
 * Implements hook_block_view().
 */
function myblockmodule_block_view($block_key){
    $block = array();

    if($block_key == 'myadblocks'){ //We only want to define the content of OUR block
        //This is the title of the block.
        $block['subject'] = '';

        //Define the block content.
        $block['content'] = '<script>some ad js comes here</script>';
    }
    elseif ($block_key == 'myadblocks2') {
      $block['subject'] = '';
      $block['content'] = '<script>some other ad js</script>';
    }

    return $block;
}

My intention is to user these blocks instead of my current blocks that were volnurable to to script injection.

However, I am not sure the new module-based blocks will be more secure than the old admin-generated blocks. So appreciate your critical review of the module above.

Answer 1

Is this block safe from code injection exploit?

Essentially yes.

You're hardcoding the javascript, so there's no vector by which an attacker can inject code from the client side. This will of course change if you're interpolating variables into the JS code that have come from a potentially insecure source (i.e. the user). Those will need to go through filter_xss().

That's a bit over-simplified, there could of course be other vectors outside of this context which would allow an attacker to manipulate the PHP file itself, which could theoretically be invoked from the client. But in-and-of-itself, the method you've chosen is secure against XSS attempts.

Answer 2

It seems from your older question that your problem with old blocks was mainly the fact that someone was able to log in and edit admin-only things, wasn't it? If so, then no. This will not make you safe. If someone hijacked your admin account, he will be able to switch these off and create new, abused ones.

And if problem was with the JS itself, then switching from Full HTML block to module-provided one, and leaving the same script in it, will not help, either.