Caja (pronounced/ˈkɑːhɑː/KAH-hah)[1] was aGoogle project forsanitizing third partyHTML,CSS, andJavaScript. On January 31, 2021, Google archived the project due to known vulnerabilities and lack of maintenance to keep up with the latest web security research, recommending instead theClosure toolkit.[2]
The Caja project was led by Jasvir Nagra with the JavaScript portion designed by Google research scientistMark S. Miller in 2008[3][4] as a JavaScript implementation for "virtual iframes" based on the principles ofobject-capabilities. It would takeJavaScript (technically,ECMAScript 5 strict mode code),HTML, andCSS input and rewrite it into a safe subset of HTML and CSS, plus a single JavaScript function with nofree variables. That means the only way such a function could modify an object, was if it was given areference to the object by the host page. Instead of giving direct references toDOM objects, the host page typically gives references to wrappers that sanitize HTML, proxyURLs, and prevent redirecting the page; this allowed Caja to prevent certainphishing andcross-site scripting attacks, and prevent downloadingmalware. Also, since all rewritten programs ran in the same frame, the host page could allow one program to export an object reference to another program; then inter-frame communication was simply method invocation.
The word "caja" is Spanish for "box" or "safe" (as in a bank), the idea being that Caja could safely contain JavaScript programs as well as being acapabilities-basedJavaScript.
Caja was used byGoogle in itsGoogle Apps Script[5] products. In 2008MySpace[6][7] andYahoo![8] had both deployed a very early version of Caja.
| Dialects | |||||||||
|---|---|---|---|---|---|---|---|---|---|
| Engines | |||||||||
| Frameworks |
| ||||||||
| People |
| ||||||||
| Other | |||||||||
 Lists:JavaScript libraries •Ajax frameworks •Server-side JavaScriptComparison:JavaScript web frameworks | |||||||||
