Nilesh Kumar

<SCRIPT SRC="script.js" POLICY="(function () {...}">

<SCRIPT SRC="" POLICY=" 
    var substr = String.prototype.substring; 
    var parse = JSON.parse; 
    around(window.eval, 
        function (oldEval, str) {  
            var str2 = uCall(str, substr, 1,  str.length - 1);  
            var res = parse(str2);  
            if (res) return res;  
            else throw "eval only for JSON";   
} );">

• Disallow any code from being introduced after a point, such as after the main library loads. It can be done in the following way :

  <script src="main.js" policy=" around(script, function () { return ''; }); "/>

  .
• Restrict XMLHttpRequest to secure connections. An instance of the XMLHttpRequest object provides the method open(mode, url, sync, username, password), where the last two parameters are optional. A program that specifies a username and password has heightened security concerns. The following policy ensures, if a username and password is supplied, that the connection is over HTTPS.
  

  let substr : K = String.prototype.substr;  
  around((new XMLHttpRequest()).open,  
      function (o : K, m : U, u : U, a : U, nm : U, pw: U)  
      {  
          let name : K = toPrimitive(nm);  
          let password : K = toPrimitive(pw);  
          let url : K = toPrimitive(u);  
          if ((name || password)  
              && uCall(url, substr, 0, 8) != "https://") {  
              curse(); throw "Use HTTPS for secure a XHR.";  
          } else 
            return uCall(this, o, m, url, a, name, password); 
  });

• Disable dynamic IFRAME creation. It can be done as follows :
  

  around(document.createElement,  
      function (c : K, tag : U) {  
          let elt : U = uCall(document, c, tag);  
          if (elt.nodeName == "IFRAME") throw ’err’;  
          else return elt; });

• eval restrictions. Let us understand this through an example, you might allow the trusted jQuery library to initialize itself using eval but, for all subsequent code, you might then restrict usage of eval to deserializing JSON objects.
  

  <script src="jQuery.js" policy="  
      let parse : K = JSON.parse;  
      around(eval : K, function (_ : K, evalStrArg : U) {  
          curse();  
          return parse(evalStrArg); }); }); "/>