Caja project
Template:Short description Caja (pronounced /ˈkɑːhɑː/ Script error: No such module "Respell".)[1] was a Google project for sanitizing third party HTML, CSS, and JavaScript. On January 31, 2021, Google archived the project due to known vulnerabilities and lack of maintenance to keep up with the latest web security research, recommending instead the Closure toolkit.[2]
The Caja project was led by Jasvir Nagra with the JavaScript portion designed by Google research scientist Mark S. Miller in 2008[3][4] as a JavaScript implementation for "virtual iframes" based on the principles of object-capabilities. It would take JavaScript (technically, ECMAScript 5 strict mode code), HTML, and CSS input and rewrite it into a safe subset of HTML and CSS, plus a single JavaScript function with no free variables. That means the only way such a function could modify an object, was if it was given a reference to the object by the host page. Instead of giving direct references to DOM objects, the host page typically gives references to wrappers that sanitize HTML, proxy URLs, and prevent redirecting the page; this allowed Caja to prevent certain phishing and cross-site scripting attacks, and prevent downloading malware. Also, since all rewritten programs ran in the same frame, the host page could allow one program to export an object reference to another program; then inter-frame communication was simply method invocation.
The word "caja" is Spanish for "box" or "safe" (as in a bank), the idea being that Caja could safely contain JavaScript programs as well as being a capabilities-based JavaScript.
Caja was used by Google in its Google Apps Script[5] products. In 2008 MySpace[6][7] and Yahoo![8] had both deployed a very early version of Caja.
See also
References
Page Template:Reflist/styles.css has no content.
- ^ Page Module:Citation/CS1/styles.css has no content.Miller, Mark (10 October 2007). "[e-lang] [cap-talk] Caja discussion on the Caplet Group". EROS-OS.org. Archived from the original on 17 May 2008.
- ^ Page Module:Citation/CS1/styles.css has no content."Introduction - Caja". Google Developers. Archived from the original on 22 January 2021.
- ^ Page Module:Citation/CS1/styles.css has no content.Miller, Mark S.; Samuel, M.; Laurie, B.; Awad, I.; Stay, M. (7 June 2008). "Safe active content in sanitized JavaScript". Google Scholar.
- ^ Page Module:Citation/CS1/styles.css has no content.Synodinos, Dio (25 February 2011). "ECMAScript 5, Caja and Retrofitting Security, with Mark S. Miller". InfoQ.
- ^ Page Module:Citation/CS1/styles.css has no content."Html Service: Caja Sanitization". Google Developers. Archived from the original on 26 August 2013.
- ^ Page Module:Citation/CS1/styles.css has no content."MySpace: Caja JavaScript scrubbing ready for prime time". 4 February 2008. Archived from the original on 1 October 2008.
- ^ Page Module:Citation/CS1/styles.css has no content."Web 2.0 Investors: Pay Attention To Caja". Tim Oren's Due Diligence. 11 April 2008.
- ^ Page Module:Citation/CS1/styles.css has no content.Pullara, Sam (28 October 2008). "OpenSocial API Blog: Launched: Yahoo!'s First Implementation of OpenSocial Support". OpenSocial. Archived from the original on 16 December 2008.
External links
Page Module:Side box/styles.css has no content.Page Template:Sister project/styles.css has no content.
- Official website, source code
- Caja playground
- Caja draft specification: "Safe active content in sanitized JavaScript", Mark S. Miller, Mike Samuel, Ben Laurie, Ihab Awad, Mike Stay
- Yahoo!/Google Caja Javascript Sandbox
Lua error in package.lua at line 80: module 'Module:Navbox/configuration' not found. Lua error in package.lua at line 80: module 'Module:Navbox/configuration' not found. Lua error in package.lua at line 80: module 'Module:Navbox/configuration' not found.
