ABSTRACT
JavaScript provides access to all resources via object properties. An access control mechanism that protects confidential information for such a language has to gauge traversals of the object graph. We propose a domain specific language to specify sets of objects, assign read and write permissions to them, and enforce these permissions in limited scopes of a program. To obtain complete interposition, we build the enforcement mechanism into the scripting engine.
