> How about create a JavaScript library that sandboxes execution of third-party scripts [...] There has been some work done in this direction. I don't know how

> How about create a JavaScript library that sandboxes execution of third-party scripts [...] There has been some work done in this direction. I don't know how active the project is, but it's called ADsafe (http://www.adsafe.org/ http://www.adsafe.org/). It's a subset of regular JavaScript and doesn't allow access to global variables or the DOM, instead giving access to an ADSAFE object to limit the access of the script. ADsafe makes it safe to put guest code (such as third party scripted advertising or widgets) on a web page. ADsafe defines a subset of JavaScript that is powerful enough to allow guest code to perform valuable interactions, while at the same time preventing malicious or accidental damage or intrusion. The ADsafe subset can be verified mechanically by tools like JSLint so that no human inspection is necessary to review guest code for safety. The ADsafe subset also enforces good coding practices, increasing the likelihood that guest code will run correctly. Some of the things removed: - Global variables: Limited access to Array, Boolean, Number, String, and Math is allowed. - Dangerous methods and properties: arguments callee caller constructor eval prototype stack unwatch valueOf watch - Date and Math.random: Access to these sources of non-determinism is restricted in order to make it easier to determine how widgets behave.