How to prevent DOM object access by lua, but keep variable transfer between js & lua ?

[Flash-ang]

example to add script from lua :

<script type="application/lua">

local js = require "js"
local g = js.global;
local window = js.global;
local document = window.document

s = document:createElement('script');
s.src = "https://www.domain.com/js/grab_info.js";
document:getElementsByTagName("head")[0]:appendChild(s);

</script>

[daurnimator]

but keep variable transfer between js & lua ?

This is unlikely to be possible: it's too easy to escape if you have a javascript object, as you can e.g. look at Object.prototype and such.

[privateschoolaccount]

shove the lua code in a iframe and add whatever js variables you want to access from lua to the iframe's window object.