Isn't Caja supposed to deal with this family of issues? Could you just use that? (Well, last I looked it needed a program on the server to preprocess the foreign JS code.)