How effective is Caja at preventing XSS?

Question

I recently found Caja which looks like an effective way of preventing XSS. From their site:

The Caja Compiler is a tool for making third party HTML, CSS and JavaScript safe to embed in your website. It enables rich interaction between the embedding page and the embedded applications. Caja uses an object-capability security model to allow for a wide range of flexible security policies, so that your website can effectively control what embedded third party code can do with user data.

and also:

Caja turns a piece of Web content -- roughly, a snippet of HTML, CSS and JavaScript that you would see within the body tag of an HTML page -- into a Caja module. This module is represented as a single JavaScript module function that can be run within a Caja container.

Does this mean that using Caja I could give a user the ability to enter HTML/CSS without having to worry about possible XSS attacks?

Answer 1

In my opinion that totally depends if you are just using Caja, or whether you have got a backend language as well.

The reason I say that is because you could have something like a search module on the backend which doesn't sanitize any data, thus a malicious well-formed string could be output, causing an XSS (or other attacks).

If you are talking about how effective is Caja at preventing XSS from it's side, then from what I've read, it looks quite good, but I have never personally used it, however I hear good things from it.