The object level capabilities that show up in E seem like an interesting addition to the Javascript language, especially considering the security issues that Javascript programs face. Has anyone tried implementing an object-capability type security system in Javascript, or by modifying a javascript VM?

  • May I ask what E reffers to? Is there some article I can read to understand what this question is about? Oct 24, 2015 at 19:45
  • 1
    start at erights.org. E is a programming language that follows the capability security paradigm, but there are many other interesting things about the language.
    – PanCrit
    Aug 6, 2019 at 6:31

2 Answers 2


Mark Miller, the creator of E, is on the ECMAScript committee, and has been working very hard to ensure that ECMAScript 5/Strict is almost capability-safe, or, as he calls it "trivially securable".

He is currently working on SES (Secure ECMAScript), which is a capability-safe subset of ECMAScript, which, interestingly, can actually be implemented within ECMAScript 5/Strict itself. It basically consists of a small bootstrap script, which redefines some global objects and functions. Any code that is loaded after this bootstrap script has run, is guaranteed to be capability-safe.

They also have a superset of SES, called Dr. SES (Distributed Resilient Secure ECMAScript), which basically extends the capability-safety of SES into a distributed setting across multiple machines.

Previously, Mark Miller created Caja. However, being based on ECMAScript 3, Caja is much more complex than SES or Dr. SES, because ES3 is not "trivially securable". In particular, Caja is a pretty complex compiler toolchain, which performs a whole-program-transformation and some quite sophisticated static analysis.

initSES.js is just a small script. The main difference is that there are some fundamental security flaws in ES3 which have been fixed in ES5/Strict. The main problem with ES5/Strict is ambient authority provided by the global object, but that can easily be remedied by simply removing or overwriting sensitive functions such as eval, which can be achieved with a simple bootstrap script such as the aforementioned initSES.js and does not require a transformation of the entire source program.


Google caja is a pretty serious attempt: http://code.google.com/p/google-caja/

[..] Caja provides a compiler (a "cajoler") that takes the web application and produces a "cajoled" HTML web application. The cajoler tries to verify security properties by doing static analysis, and where it cannot it rewrites the input to add runtime checks.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.