Their list of typical attack vectors in ES3 is very eye opening: http://code.google.com/p/google-caja/wiki/AttackVectors http://code.google.com/p/google-caja/w/list?q=label:Attack-V...

You can also easily play with the Valija and ES5/3 dialect here http://caja.appspot.com