Ha, here's an old thread where I asked the caja developers about that exact scenario: https://groups.google.com/forum/#!topic/google-caja-discuss/RAi-hHiClRA ht

Ha, here's an old thread where I asked the caja developers about that exact scenario: https://groups.google.com/forum/#!topic/google-caja-discuss/RAi-hHiClRA https://groups.google.com/forum/#!topic/google-caja-discuss/... Some possible mitigations but I don't know if they ever implemented them.