ZAC is a library for access control in JavaScript based on AspectScript. ZAC combines very interesting features: dynamic enforcement of policies, extensible access control specifications, and a fine granularity level in which policies are enforced at the level of objects instead of pages/scripts. All these features augment the precision of access control policies.

ZAC is targeted to sites that want to prevent external code from interfering with their pages. Examples of such sites are iGoogle, My Yahoo, Web mashups, etc.

Below in this page you can try ZAC on-line. Additionally, we provide a Firefox extension that enforce ZAC policies at the client side. Despite not being this the main purpose of ZAC, it turns out to be an interesting application of the approach.

Download and install instructions for zac4firefox can be found here.

Please visit this page to view ZAC in action. You can also interactively try ZAC in this page. Just write some JavaScript code, choose the restrictions you want to enforce, and press “Run it!”. The code will be automatically transformed and executed in the interal frame below. The HTML code on the second textarea is also appended to the resulting page, so the JavaScript code can access it.

In the sample code below, the alert function is called in four different ways: (1) a direct call, (2) an indirect call (using delegation), (3) another indirect call (using eval), and (4), a scheduled invocation. The four attempts end with an exeption if the restriction R_ALERT is active. Please notice that an exception is thrown when the first alert is about to be executed, so you will have to incrementally comment the calls to alert in order to test the remaining ones.

(The exceptions thrown by ZAC can be observed in the “Error Console” of Firefox, or in the console of Firebug if installed.)

The ZAC library can be downloaded from here. ZAC is based on AspectScript, which is available here.