8.6. Forms, the Sandbox, and XSS

When JavaScript was first released, there was understandable concern about opening a web page that would execute a bit of code directly in your machine. What if the JavaScript included something harmful, such as code to delete all Word documents, or worse, to copy them for the script originator?

To prevent such occurrences and to reassure browser users, JavaScript was built to operate in a sandbox: a protected environment in which the script can’t access the resources of the browser’s computer. Additionally, browsers implement security conditions above and beyond those established as a minimum for the JavaScript language. These are defined in a browser-specific security policy, which determines what the script can and cannot do.