Note that caja doesn't protect against local denial-of-service attacks: user-written javascript executed with it could allocate tons of memory or run forever (`while(true){}`). This may or may not be a problem depending on your use-case. (If you're using caja for code written by mostly-trusted 3rd parties, or for one user's code only on their own machine, then it's not much of an issue. If you're serving code written by one user to another, then it could be a problem.)
Comments
https://developers.google.com/caja/
Used it a few years ago. It was a little finnicky to get working right but I was impressed at the time. No idea where the project is at nowadays.
Note that caja doesn't protect against local denial-of-service attacks: user-written javascript executed with it could allocate tons of memory or run forever (`while(true){}`). This may or may not be a problem depending on your use-case. (If you're using caja for code written by mostly-trusted 3rd parties, or for one user's code only on their own machine, then it's not much of an issue. If you're serving code written by one user to another, then it could be a problem.)
Ha, here's an old thread where I asked the caja developers about that exact scenario: https://groups.google.com/forum/#!topic/google-caja-discuss/...
Some possible mitigations but I don't know if they ever implemented them.
i saw caja, but it looks really complex, was hoping for something better these days :(