googlearchive/caja
Caja is a tool for safely embedding third party HTML, CSS and JavaScript in your website. observed · 2026-08-28
Health v2 · maintenance only
10/100
- Activity 0
- Release rhythm 35
- Longevity 100
Flags: no_releases archived
How is this computed?
round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10) — computed 2026-09-03. Adoption (stars, forks) is never an input.
- gap_med: n/a
- age_days: 4158
- days_rel: n/a
- days_push: 2100
- n_releases_24m: 0
Adoption not part of the score
1132 stars · 113 forks observed · 2026-08-28
What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded
Caja is a Java-based tool for safely embedding third-party HTML, CSS, and JavaScript in a website using an object-capability security model. It compiles untrusted code so it can interact richly with the host page without stealing cookies, phishing, or sniffing user data.
Use cases
- safely embed third-party HTML, CSS and JavaScript in my website
- run untrusted JavaScript in a sandbox on my page
- build secure mashups with multiple third-party apps on one page
- prevent embedded widgets from stealing cookies or redirecting to phishing sites
- let a REST service supply JavaScript that is safe to embed
- use new JavaScript features on older browsers
When to choose
- you maintain a legacy system already built on Caja
- you need object-capability sandboxing of third-party code on very old browsers
When to avoid
- starting a new project - the project was archived in 2021 and has known unpatched security vulnerabilities
- you need actively maintained HTML/CSS sanitization - use Closure library or DOMPurify instead
- you need modern web security mitigations like CSP and Trusted Types
Facets
library · maturity abandoned
security templating serialization security web-development frontend jvm sandboxing html-sanitizer css-sanitizer object-capability xss-prevention third-party-embedding deprecated google-archive web-server
1 source
- readme: https://github.com/googlearchive/caja · fetched 2026-08-28 · 221ef4a104f9
Member repositories
| Repository | Role | Health v2 |
|---|---|---|
| googlearchive/caja | main | 10 |
For agents
markdown · JSON · MCP: product_card(name="googlearchive/caja")
Data as of 2026-08-30T08:39:29.467469+00:00 · Report a problem