LGTM, but see my question.
http://codereview.appspot.com/93041/diff/2002/2004 File src/com/google/caja/cajita.js (right): http://codereview.appspot.com/93041/diff/2002/2004#newcode1373 Line 1373: if (obj[name + '_canRead___']) { return (name in obj); } Why not do it by leaving the original line alone and putting if (!(name in obj)) { return false; } on the previous line? I think it would be observationally equivalent to what you wrote, but a bit more in the style of the rest of the access checking functions. http://codereview.appspot.com/93041
