Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I just read about Caja, which is a "sanitized" version of JavaScript. But I'm wondering - what is the big problem with JavaScript(it seems so widely used )? Just how dangerous is it?

share|improve this question

closed as too broad by gnat, MichaelT, GlenH7, Snowman, Wayne M Sep 1 '14 at 0:52

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.

It appears to me the main difference here (security wise) is it does not give direct exposure to the DOM. Which will (in theory I suppose) negate silly errors introduced by some developers. – rlemon Mar 29 '12 at 23:17
@rlemon - Thank You Very Much! – Adel Mar 30 '12 at 1:26
up vote 3 down vote accepted

The changes it makes vs. regular javascript are pretty well described here.

From that reference:

Caja takes JavaScript (technically, ECMAScript 5 strict mode code), HTML, and CSS input and rewrites it into a safe subset of HTML and CSS, plus a single JavaScript function with no free variables. That means the only way such a function can modify an object is if it is given a reference to the object by the host page. Instead of giving direct references to DOM objects, the host page typically gives references to wrappers that sanitize HTML, proxy URLs, and prevent redirecting the page; this allows Caja to prevent certain phishing attacks, prevent cross-site scripting attacks, and prevent downloading malware. Also, since all rewritten programs run in the same frame, the host page can allow one program to export an object reference to another program; then inter-frame communication is simply method invocation.

And, Google's site on Caja.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.