3 ms·
https://developers.google.com/caja/ https://developers.google.com/caja/ Used it a few years ago. It was a little finnicky to get working right but I was impres
by dougk16 10y ago
https://developers.google.com/caja/ https://developers.google.com/caja/
Used it a few years ago. It was a little finnicky to get working right but I was impressed at the time. No idea where the project is at nowadays.
- novaleaf 10y agoi saw caja, but it looks really complex, was hoping for something better these days :(
- AgentME 10y agoNote that caja doesn't protect against local denial-of-service attacks: user-written javascript executed with it could allocate tons of memory or run forever (`while(true){}`). This may or may not be a problem depending on your use-case. (If you're using caja for code written by mostly-trusted 3rd parties, or for one user's code only on their own machine, then it's not much of an issue. If you're serving code written by one user to another, then it could be a problem.)
- dougk16 10y agoHa, here's an old thread where I asked the caja developers about that exact scenario: https://groups.google.com/forum/#!topic/google-caja-discuss/RAi-hHiClRA https://groups.google.com/forum/#!topic/google-caja-discuss/... Some possible mitigations but I don't know if they ever implemented them.