Q:

Is JavaScript self-injection dangerous?

I have a toy web application that can be described roughly as a per-user key-value store. After logging in, the user can view and modify her set of key-value pairs. The keys and values are stored in a database on the server. The keys or values are not shared among users in any way.
I just discovered that JavaScript code included in the keys or values was not properly escaped. So if a user added a key foo with a value of bar <script>alert(1)</script>, the script would execute in the user's browser.
Of course, I fixed this as soon as I noticed it. But I was left wondering: Can this be exploited to do anything harmful? Remember that the key-value pairs are ONLY ever shown to the user who created them.
(The only scenario I could think of is rather far fetched: An attacker convinces the user to navigate to my web application and then to click on a rogue bookmarklet. The bookmarklet saves a key-value pair with a script that steals the user's key-value pairs. Because this is persisted to the database, the key-value pairs will be sent to the attacker every time the user loads the page. But with a rogue bookmarklet you can do almost anything anyway...)

A:

There may be some potential for a CSRF attack, where an attacker maliciously saves a key value pair on behalf of your users.  Then the executable JS in the key value pair might be able to be used for a run of the mill XSS attack to steal their cookies and potentially allow the attacker access to the application as the victim.  
I agree with Jimmy's comment.  If there's any possibility to properly scrub the user input, that would definitely be my first priority.   

A:

It's hard to say without looking at your app in detail, but yes, there is a potential for attacks here.  If there is any way that a key-value pair might get stored into a user's profile, where the value is partially or completely controlled by someone else, then this could lead to an XSS attack.
Example: Suppose that there's a way to send a user an instant message, and the message automatically gets saved into the recipient's key-value store (or perhaps there is a button the user can press to save it).  Then you've got problems.
If your app has a lot of functionality, there are many ways that untrusted data might end up getting stored into the key-value store.  Therefore, I would suggest that you fix this vulnerability.  A standard way to fix this is escape the value before inserting it into the HTML document.

