About language interpreters, we discussed adaptable language interpreters that could validate code in different ways (e.g., with different type systems) before executing the code. What are "safe" ways to use eval (e.g., just for data to load JSON data)? What guarantees could we provide with a well-specified language interpreter with customizable semantics?
A further step would be to think about script, client intepreter, and server interactions.
A related issue is string analysis and sanitizers. Sanitizers are hard to get right. We may come up with a declarative language to write sanitizers that could give some guarantees.
Manu brought up some work at SAS this year by Andres Moller: http://www.brics.dk/~amoeller/papers/tajs/
Zhendong Su has a line work on web security (primarily with Gary Wassermann). http://wwwcsif.cs.ucdavis.edu/~wassermg/research/
We should look at Phil Wadler's Links project (http://groups.inf.ed.ac.uk/links/). Also, Nik Swamy and Mike Hick's work on SELinks (http://www.cs.umd.edu/projects/PL/selinks/).
Ben Livshits has a number of projects that might be relevant (http://research.microsoft.com/en-us/um/people/livshits/projects.htm).
We should look at studies on what are common uses of eval. Manu mentioned that Andres Moller may some work on this.