[flushot]

I don't see why a language like JS couldn't be used for evaluating rules when sandboxed. Looks like there's a project that does just that: https://developers.google.com/caja/