Simon Willison’s Weblog

Secure mashups with dojox.secure (via) dojox.secure is brilliant and terrifying at the same time. It provides a full featured API for running untrusted JavaScript in a sandbox, by parsing and validating that code against a variant of Douglas Crockford’s ADsafe JavaScript subset. It could be fantastically useful, but it’s difficult to judge how secure this approach really is.

# 24th September 2008, 4:08 pm / dojox, dojo, javascript, security, sandboxing, adsafe, kriszyp, dojoxsecure, mashups