ZAC is a library for access control in JavaScript based on AspectScript. ZAC combines very interesting features: dynamic enforcement of policies, extensible access control specifications, and a fine granularity level in which policies are enforced at the level of objects instead of pages/scripts. All these features augment the precision of access control policies.

ZAC is targeted to sites that want to prevent external code from interfering with their pages. Examples of such sites are iGoogle, My Yahoo, Web mashups, etc.

Below in this page you can try ZAC on-line. Additionally, we provide a Firefox extension that enforce ZAC policies at the client side. Despite not being this the main purpose of ZAC, it turns out to be an interesting application of the approach.

Download and install instructions for zac4firefox can be found here.

Please visit this page to view ZAC in action. You can also interactively try ZAC in this page. Just write some JavaScript code, choose the restrictions you want to enforce and press “Run it!”. The code will be automatically transformed and executed in the interal frame below. The HTML code on the second textarea is also appended to the resulting page, so the JavaScript code can access it.

In the sample code below, alert is called using four different alternatives: (1) direct call, (2) indirect call (using delegation), (3) indirect call (using eval), and (4), scheduled invocation. The four attempts end with an exeption if the restriction R_ALERT is active. Please notice that an exception is thrown when the first alert is executed, so you will have to incrementally comment the calls to alert in order to test the following ones.

(The exceptions thrown by ZAC can be observed in the “Error Console” of Firefox, or in the console of <a href=“http://getfirebug.com/”>Firebug</a> if installed.)

The ZAC library can be downloaded from here. ZAC is based on AspectScript, which is available here.