On the following page, Figure 2 describes examples of general policies that apply to client Web pages, their script code, and the nodes and attributes of document data. On the same page, Figure 3 shows how these poli- cies can be readily instantiated usingMET callback func- tions; this code should be read in conjunction with Ap- pendix A. In what follows, these policies are referred to by their number, in parentheses. Policies (1), (3), and (6) are examples that restrict potentially dangerous types of document nodes, allow scripts only in certain portions of the document, or limit scripts to a whitelist of trusted scripts (as in [9]). Policies (2), (4), and (5).
