On Mon, May 23, 2016 at 2:57 AM, 'Lukas Bombach' via Google Caja Discuss < [email protected]> wrote:
> Hi there, > > we can really make use of this project (or something similar) at welt.de > one of Germany's biggest daily newspapers. I have been told on GitHub > <https://github.com/google/caja/issues/2000> that, while no new features > are being added, the project is being kept running. I am not quite sure > what this implies. Our situation is that we have students writing widgets > that might be shown on our front page and they should not break anything > else on the page by, let's say, doing something like document.body.innerHTML > = "";. Since we don't want to have iFrames over iFrames on our site, > Why don't you want to use iframes? In the cases where they can be used, iframes (with or without the sandbox attribute) are a much, much lighter-weight solution than Caja. > it seems the only way to deal with this is to check the code, supported by > tools like Caja (?). > Caja does not “check” code. It runs arbitrary code in a restricted *environment*. > So I am wondering if Caja is suitable for this and if it is still > maintained in the way (and feature-complete) that i still can be used for a > high-traffic website. > It depends on what you want to do. If you want to run The Latest Hot New Web Thingies, like say a WebGL game, Caja won't work for you (both because WebGL, being a newer feature, is not supported, and because the performance cost is too high). If you want more straightforward interactive HTML stuff, it'll likely be fine. It's hard to say exactly what will work and what won't, because there are no “browser API levels” that we can point at to say Caja does or doesn't support them, only individual features. -- --- You received this message because you are subscribed to the Google Groups "Google Caja Discuss" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
