Differences

This shows you the differences between two versions of the page.

--- zac [2010/05/07 23:05]
aspectscript
+++ zac [2010/05/10 18:49] (current)
aspectscript
@@ Line 1: / Line 1: @@
 ====== ZAC ======
-ZAC is a library for access control in JavaScript based on [[/|AspectScript]]. ZAC combines very interesting features: dynamic enforcement of policies, extensible access control specifications, and a finer granularity level in which policies are enforced at the level of objects instead of pages/scripts. Al these features augment the precision of access control policies.
+ZAC is a library for access control in JavaScript based on [[/|AspectScript]]. ZAC combines very interesting features: dynamic enforcement of policies, extensible access control specifications, and a fine granularity level in which policies are enforced at the level of objects instead of pages/scripts. All these features augment the precision of access control policies.
+ZAC is targeted to sites that want to prevent external code from interfering with their pages. Examples of such sites are iGoogle, My Yahoo, Web mashups, etc.
+Below in this page you can try ZAC on-line. Additionally, we provide a Firefox extension that enforce ZAC policies at the client side. Despite not being this the main purpose of ZAC, it turns out to be an interesting application of the approach.
 ======= ZAC extension for Firefox (zac4firefox) =======
@@ Line 8: / Line 12: @@
 ======= Try ZAC =======
-Please visit [[http://www.dcc.uchile.cl/~rtoledo/js/zac/|this page]] to view ZAC in action. You can also interactively try ZAC in this page. Just write some JavaScript code, choose the restrictions you want to enforce and press “Run it!”. The code will be automatically transformed and executed in the interal frame below. The HTML code on the second textarea is also appended to the resulting page, so the JavaScript code can access it.
+Please visit [[http://www.dcc.uchile.cl/~rtoledo/js/zac/|this page]] to view ZAC in action. You can also interactively try ZAC in this page. Just write some JavaScript code, choose the restrictions you want to enforce, and press “Run it!”. The code will be automatically transformed and executed in the interal frame below. The HTML code on the second textarea is also appended to the resulting page, so the JavaScript code can access it.
+In the sample code below, the alert function is called in four different ways: (1) a direct call, (2) an indirect call (using delegation), (3) another indirect call (using eval), and (4), a scheduled invocation. The four attempts end with an exeption if the restriction R_ALERT is active. Please notice that an exception is thrown when the first alert is about to be executed, so you will have to incrementally comment the calls to alert in order to test the remaining ones.
+(The exceptions thrown by ZAC can be observed in the "Error Console" of Firefox, or in the console of [[http://getfirebug.com/|Firebug]] if installed.)
 <html>
@@ Line 26: / Line 34: @@
 setTimeout(function(){
   alert("I'm evil (d)");
-}, 1000);
+}, 500);
 </textarea>
@@ Line 67: / Line 75: @@
 ======= Download ZAC =======
-The ZAC library can be downloaded from [[http://www.dcc.uchile.cl/~rtoledo/js/zac/ZAC.js|here]]. ZAC is based on AspectScript, which is available [[Download|here]].
+The ZAC library can be downloaded from [[http://www.pleiad.cl/aspectscript/external/zac/zac.js|here]]. ZAC is based on AspectScript, which is available [[Download|here]].