[dalke]

That's not it. For example, it accepts "return x|x&x;" . The restriction is that only a handful of Javascript operations are allowed. Anything else gives a hard-to-understand error message.