Before commenting on the specifics, I have a more general question.
Why not do something like limitSrcCharset, encoding all unicode
characters, but do it unconditionally, not as a test, but as a
parserless source-to-source rewrite prior to other mitigations and
calling atLeastFreeVarNames? Perhaps in the mitigateSrcGotchas wrapper
function in startSES (as opposed to the lower level one in
mitigateGotchas, which is not necessarily available)?
If this or something like it could work it would be a lot simpler and
cheaper.
https://codereview.appspot.com/10205043/
--
---
You received this message because you are subscribed to the Google Groups "Google Caja Discuss" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
