Could a CSRF attack have any direct way of accessing or manipulating its target site's javascript variables?

Question

Does it open any attack vector if an ajax-driven site uses a unique token stored as a javascript variable and verifies it with every request to prevent CSRF -- provided that the site is free from XSS holes?

Answer 1

It doesn't open it up to attack. If the site is free from XSS holes, there is no way another page could get the token from a javascript variable.