ADsafe questions and answers

These answers describe the original ADsafe model and the source bundled with this edition. They do not certify code for running hostile scripts today.

What is ADsafe?

ADsafe is Douglas Crockford’s historical approach to guest JavaScript: restrict the language, check that restriction mechanically and expose useful host services through controlled interfaces. A widget combines an HTML fragment with guest code. Start with the guide for the complete shape.

Does loading adsafe.js sandbox my scripts?

No. The original design also requires language and structure checks and a host that preserves its assumptions. The runtime does not turn unrestricted callbacks into restricted code. In particular, calling ADSAFE.go does not remove access to globals that ordinary code already possesses.

Why must the root be a DIV with a special ID?

The root identifies the fragment whose interface the widget receives. The documented convention uses uppercase ASCII letters and a trailing underscore; child IDs share the prefix. The host ensures uniqueness across the page. This convention supports the verifier and runtime but is not a separate browser security boundary.

Can I use any CSS selector with dom.q?

No. ADsafe has its own query parser. The archived docs distinguish hunters, which find nodes, from filters that narrow a selection. Begin with the supported forms in the query reference. Browser acceptance of a selector says nothing about acceptance by this parser.

What happens when a query finds nothing?

It returns an empty bunch. The documented setters generally have nothing to change, while singular getters return undefined and plural getters return an array. Use count() to inspect selection size. An invalid query is a different case and can throw an error.

Why use ADSAFE.get instead of object[key]?

A computed string could name a member that the subset forbids. The guarded helper checks the name at runtime. The original rules permit some bracket expressions, including forms known to produce a number; they do not ban every array access. The helpers are not a substitute for reviewing the objects and values supplied by the host.

Does an approved library automatically get the DOM?

No. The archived library factory receives the registered libraries, rather than the widget’s dom parameter. Guest code can explicitly pass that interface to a library method. Every returned method and value still needs to preserve the intended authority boundary.

Why does off("click", handler) remove too much?

The archived DOM page describes removal of one handler. The local runtime’s off method takes only a type and clears the selection’s handlers for that type; without a string type it clears all handlers. The extra argument does not narrow removal. See the version-specific event note.

Are the examples original ADsafe widgets?

No. This edition’s Roman, Bats and Sudoku exercises are newly written demonstrations served as ordinary page code. Original sample routes and topics are preserved, but no verifier acceptance or historical behavior match is claimed. The walkthroughs explain what readers can learn from them.

Should I use this runtime as a new security boundary?

This reference provides no basis for that recommendation. It documents historical rules and observable source behavior. Current deployments require a separately evaluated design, maintained components and a threat model. Read the limits and the comparison of sandboxing approaches before drawing conclusions from a successful demo.