1. Defining and using safe JavaScript subsets (in the style of Google's Caja [3] and AdSafe [4], though probably that ship has sailed and cramming syntax sugar

1. Defining and using safe JavaScript subsets (in the style of Google's Caja [3] and AdSafe [4], though probably that ship has sailed and cramming syntax sugar into JS is the order of the day instead) 2. Defining and using safe CSS subsets (with countermeasures against click-jacking/-phishing, and hiding "nose print" etc.) though granted this is challenging; I had hoped a formal semantics for CSS came along (such as in [2]) but it didn't 3. Using HTML-aware template engines (such as [1] but there are maybe lighter approaches with hard-coded HTML rules as well; disclaimer: my project) [1]: http://sgmljs.net/blog/blog1701.html http://sgmljs.net/blog/blog1701.html [2]: https://lmeyerov.github.io/projects/pbrowser/pubfiles/extended.pdf https://lmeyerov.github.io/projects/pbrowser/pubfiles/extend... [3]: https://developers.google.com/caja/ https://developers.google.com/caja/ [4]: http://www.adsafe.org/ http://www.adsafe.org/