Caja (pronounced "KA-ha") allows you to put untrusted third-party HTML and JavaScript inline in your page and still be secure.
Caja
- gives stricter control over what the code can do:
- no redirects to phishing pages: the window object the untrusted code has is a fake one created by the containing page
- no malware: all requests to URLs are proxied
- no XSS: dynamic HTML sanitization
- allows the untrusted code more power than is safe to give to code currently in iframes. Here are some possibilities:
- floating frames ("info windows")
- frames don't have to be rectangular
- frames can communicate without the current awkward protocols
- a reader could broadcast geographic information about the current article; a maps gadget jumps to the location, while a news gadget gets local stories and a weather gadget pulls up the weather
- similarly for financial info or entertainment info
- an extensible syntax highlighter could have plugins that can mark up text but not leak the contents to another website
- can be a bit channel (can only send information) or a code channel (can send functions)
- hosting page can control who talks to whom
Cajoled Gadget | Uncajoled Gadget |
Information for
- Gadget authors
- Just write your gadgets in Javascript/DHTML and they'll probably work right away. Try it!
- Caja on YAP, the Yahoo Application Platform
- Article on YDN discussing the benefits and gotchas of developing apps with Caja
- Containers looking to host gadgets on their pages
The computer industry has only one significant success enabling documents to carry active content safely: scripts in web pages. Normal users regularly browse untrusted sites with Javascript turned on. Modulo browser bugs and phishing, they mostly remain safe. But even though web apps build on this success, they fail to provide its power. Web apps generally remove scripts from third party content, reducing content to passive data. Examples include webmail, groups, blogs, chat, docs and spreadsheets, wikis, and more.
Were scripts in an object-capability language, web apps could provide active content safely, simply, and flexibly. Surprisingly, this is possible within existing web standards. Caja represents our discovery that a subset of Javascript is an object-capability language.
ECMAScript-262 Third Edition (ES3) Specification
Talks