By no means comprehensive. Just some things I spotted.
http://codereview.appspot.com/4535118/diff/2001/src/com/google/caja/es5-guards.js File src/com/google/caja/es5-guards.js (right): http://codereview.appspot.com/4535118/diff/2001/src/com/google/caja/es5-guards.js#newcode40 src/com/google/caja/es5-guards.js:40: toString: Object.freeze(function tokenToString() { fotgot to freeze tokenToString.prototype. This comes up below too. Should probably just use SES's cajaVM.def. http://codereview.appspot.com/4535118/diff/2001/src/com/google/caja/es5-guards.js#newcode100 src/com/google/caja/es5-guards.js:100: var failFunc = opt_failFunc || function (x) { return x; }; This will evaluate the function expression to a new identity function on every call to callWithEjector. Better to factor out. http://codereview.appspot.com/4535118/diff/2001/src/com/google/caja/es5-guards.js#newcode103 src/com/google/caja/es5-guards.js:103: // token.UNCATCHABLE___ = true; // TODO(kpreid): can't do in ES5? Correct. The whole uncatchable notion cannot be supported on a lite-verification-only strategy. http://codereview.appspot.com/4535118/diff/2001/src/com/google/caja/es5-guards.js#newcode152 src/com/google/caja/es5-guards.js:152: // newTable as well, but perhaps we should. Yes, I think we should be using WeakMap-based permissions amplification rather than MarcS's pattern of authority amplification. http://codereview.appspot.com/4535118/diff/2001/src/com/google/caja/es5-guards.js#newcode181 src/com/google/caja/es5-guards.js:181: this.seal = seal; Using "this" in defensive code is generally a really bad idea. This should be creating and returning a new object instead. http://codereview.appspot.com/4535118/diff/2001/src/com/google/caja/es5-guards.js#newcode208 src/com/google/caja/es5-guards.js:208: _es5g_mark: markSealing.seal(Object.freeze(function(obj) { // TODO(kpreid): make this nonenumerable please stay within 80 columns http://codereview.appspot.com/4535118/diff/2001/src/com/google/caja/es53.js File src/com/google/caja/es53.js (right): http://codereview.appspot.com/4535118/diff/2001/src/com/google/caja/es53.js#newcode2033 src/com/google/caja/es53.js:2033: // Tokens Are you planning to remove the parts of es53.js that are redundant with es5-guards.js? (I hope so) http://codereview.appspot.com/4535118/diff/2001/src/com/google/caja/ses/whitelist.js File src/com/google/caja/ses/whitelist.js (right): http://codereview.appspot.com/4535118/diff/2001/src/com/google/caja/ses/whitelist.js#newcode115 src/com/google/caja/ses/whitelist.js:115: WeakMap: t, "WeakMap: {..." appears below, so this seems redundant. http://codereview.appspot.com/4535118/
