"This example illustrates that library designers do not expect their functions to be called with untrusted arguments. This trust assumption is currently valid, as evidenced by the lack of actual exploits against Twitter, but becomes invalid when hosting ADsafe-verified advertisements." ³

The mechanism is small enough to run. The host page (here, Prototype.js style) adds a method to a built-in prototype; guest code that passes a blacklist verifier, because it never names eval, Function, or constructor, calls that method and gets the Function constructor back.

"use strict";
// Host page (Prototype.js style) extends a built-in prototype.
Function.prototype.evalScripts = function () { return this.constructor; };

// Guest code a blacklist verifier would pass.
const guest = () => [].map.evalScripts();

const Fn = guest();
console.log(Fn === Function, typeof Fn("return typeof globalThis")());

// The later answer: freeze the primordials before any guest code runs.
delete Function.prototype.evalScripts;
for (const ctor of [Object, Function, Array]) {
  Object.freeze(ctor); Object.freeze(ctor.prototype);
}
try { Function.prototype.evalScripts = () => 1; } catch (e) { console.log("frozen:", e.constructor.name); }
console.log("evalScripts" in Function.prototype);

Run under Node 26.2.0 on 2026-10-08. The freeze at the end is what SES lockdown() does across every intrinsic; see Since then.

"One reason why prior work has not focussed on verifying correctness of APIs is because present JavaScript, based on the 3rd edition of ECMA-262 standard, is not amenable to static analysis, for reasons discussed in section 2." ⁴

"Web browsers provide a platform for web applications. These applications rely on the browser to isolate frames from different security origins and to provide secure inter-frame communication." ⁵

A subset or dialect of JavaScript that a verifier or rewriter can check: ADsafe, Caja, FBJS, Jacaranda. The list of languages that compile to JS was the 2012 starting point for finding them: https://github.com/jashkenas/coffee-script/wiki/List-of-languages-that-compile-to-JS

The page that embeds third-party (guest) JavaScript: the publisher, in the advertising case.

A subset of JavaScript designed to run in a hosted container on Facebook.

"Safely displaying third-party advertisements is a special case of the more general secure mashup problem in which an integrator (e.g., a publisher) attempts to interact with a collection of untrusted gadgets (e.g., advertisements)." ⁶

Unlike static verifiers, dynamic enforcers transform the source program by inserting a number of run-time security checks.

Check, before the guest runs, that its source conforms to a safe subset, so that no run-time checks are needed. ADsafe, Dojo Secure and Jacaranda take this approach⁶.

The unvetted objects are the JavaScript objects that are not accessible by the guest script on the empty page. For example, all the objects created by the host page are unvetted because those objects are not present on the empty page. As another example, the document object is unvetted because it is not accessible by the guest script on the empty page, even though document exists on the empty page.⁶

A script may read only the properties of windows and documents with the same origin (protocol, host, port) as the document that contains the script. Recorded in 2012 as a quotation whose source the notes do not name:

"The same-origin policy is a sweeping security restriction on what web content JavaScript code can interact with. It typically comes into play when a web page includes <iframe> elements or opens other browser windows. In this case, the same-origin policy governs the interactions of JavaScript code in one window or frame with the content of other windows and frames. Specifically, a script can read only the properties of windows and documents that have the same origin as the document that contains the script…"

Cross-Origin Resource Sharing: the server opts in to cross-origin reads with Access-Control-Allow-Origin and related response headers. See CORS (2012 support).

Cross-origin data fetched by injecting a <script> tag whose response calls a page-supplied callback. It works under the same-origin policy because script inclusion was never restricted, which is also the problem: the provider can return arbitrary script, not just data.

ADsafe makes it safe to put guest code (such as third party scripted advertising or widgets) on a web page.

Further analysis of the system is available⁷ as well as general research on JavaScript core semantics and a verifier for JSLint (+ADsafe)⁸.

Attack vectors, from the Caja wiki (now on the Google Code archive): https://code.google.com/archive/p/google-caja/wikis/AttackVectors.wiki

GATEKEEPER disallows via lexer blacklist: with, eval, Function, setTimeout, setInterval. document.write gets an optimistic-then-verified static check and .innerHTML assignments get a runtime rewrite. arguments, Function.call and Function.apply are explicitly allowed, not restricted.

In early 2012 CORS worked in Firefox 3.5+, Safari 4+ and Chrome 4+. IE8 and IE9 offered only the partial XDomainRequest object. Presto Opera added CORS in Opera 12 (June 2012) and IE10 (October 2012) closed the gap, so by the end of 2012 every current browser supported it.

This would need to be done with tools like Esprima or parse-js unless existing tools should be used.

A manual check should be performed for global pollution; see JavaScript Global Execution Context Pollution. This is based on "3.1 Containment Architecture"⁶.

Ad code is often shifted out by the ad networks, which makes it a higher threat to a page.

A generic suite of test data should be provided to ensure that the system, when writing out data, doesn't allow for an exploit.

This is largely just about the process of using JSLint as a validation step since this is all a validation process.

Maffeis, Mitchell, Taly, CSF 2009. http://seclab.stanford.edu/websec/jsPapers/csf09-camera-ready.pdf

Finifter, Weinberger, Barth, NDSS 2010.

Publishers wish to sandbox third-party advertisements to protect themselves from malicious advertisements. One promising approach, used by ADsafe, Dojo Secure, and Jacaranda, sandboxes advertisements by statically verifying that their JavaScript conforms to a safe subset of the language.

http://www.adambarth.com/papers/2010/finifter-weinberger-barth.pdf

Taly, Erlingsson, Mitchell, Miller, Nagra, IEEE S&P 2011. Defines SESlight, an analysable subset of ES5 strict, and the ancestor of the SES work below.

http://www-cs-students.stanford.edu/~ataly/Papers/sp11.pdf

• JavaScript Global Execution Context Pollution — the 2012 companion on globals and the module pattern.
• Web Trackers Analysis (Alexa Top 800) — the same year's map of who was injecting third-party script.
• Browser adtech infrastructure — this site's own third-party surface in 2026, built to fit a connect-src 'self' CSP.
• Tainted Data in LLM Pipelines — the LLM-era version of the tainted-values task above.
• LibrePlanet 2017 — notes include JavaScript subresource integrity.