I am currently looking into Google Caja to run user-supplied JS code in the browser and in Node.
So far, I understand, that, in a browser context, "cajoled code" disallows reading and messing with the window state by running unsafe code through a full-blown parser that gets rid of all kinds of attack vectors, and then safely executing that code in an
iframe of the same origin.
However, I am currently working on a solution using HTML5's
Worker (see here) and it seems to have the same effect. What does Caja have to offer that Worker does not have, other than the ability to customize security policies? Does it have any additional safety features?