I'm working on a web framework that makes surveys. It has an expression manager which lets admin users run code on the client as Javascript. There could be a potential XSS problem when there's more than one admin, as is the case for universities. So, instead of compiling expressions to Javascript, what about compiling them to a bitcode and have a tiny VM in the browser to check for XSS? Do you think it could give better protection than just analyzing Javascript?