Ho appena letto su Caja, che è una versione "sterilizzata" di JavaScript. Ma mi chiedo - qual è il grosso problema con JavaScript (sembra così diffuso)? Quanto è pericoloso?
Le modifiche apportate rispetto al javascript normale sono descritte abbastanza bene qui .
Da tale riferimento:
Caja takes JavaScript (technically, ECMAScript 5 strict mode code), HTML, and CSS input and rewrites it into a safe subset of HTML and CSS, plus a single JavaScript function with no free variables. That means the only way such a function can modify an object is if it is given a reference to the object by the host page. Instead of giving direct references to DOM objects, the host page typically gives references to wrappers that sanitize HTML, proxy URLs, and prevent redirecting the page; this allows Caja to prevent certain phishing attacks, prevent cross-site scripting attacks, and prevent downloading malware. Also, since all rewritten programs run in the same frame, the host page can allow one program to export an object reference to another program; then inter-frame communication is simply method invocation.
E, sito di Google su Caja.
Leggi altre domande sui tag javascript security