Caja supports most of the HTML 4.01 and CSS 2.1 specs, as well as some common browser extensions. Caja tends to adhere more closely to the specs than browsers do, so it may warn about or reject nonstandard extensions that would normally work in browsers.

All YML tags work with Caja.

Caja provides proxied access to the DOM. If you look under the hood, you can see that you're actually manipulating instances of TameDocument, TameNode, etc.

Many of the common DOM operations work, such as document.getElementById, document.createElement, node.firstChild, etc. However, Caja does not implement the complete DOM spec, so uncommon operations may not work yet.

The document.write method is subject to restrictions described in DOM Limitations. Setting and getting innerHTML is supported.

Most event handlers work. You can attach handlers with HTML onevent= attributes, or with the DOM addEventListener method, or by assigning to the node.onevent property.

Note: node.onevent='...' will not work. The value must be a function.

the window.setTimeout and window.setInterval methods both work.

Note: event.fromElement is IE specific and is not supported by Caja. Instead, use event.target or event.relatedTarget, depending on the event type.

Most of our OpenSocial 0.9 support is explicitly whitelisted for use in Caja. If you get runtime "Not readable" errors related to OpenSocial objects, check if you're using an older interface that is no longer part of the standard. You might also be using an OpenSocial 0.9 feature that is not supported by YAP; see Chapter 9, OpenSocial 0.9 Compatibility.