Question

Which are the two functions that are not allowed in any secure subset?

(a) evaluate() and restrict()

(b) eval() and the Function() constructor

(c) debugger() and test()

(d) eval() and debugger()

I had been asked this question in homework.

Question is taken from JavaScript Subsets in chapter Classes and Modules in JavaScript of JavaScript

Answer 1

Right answer is (b) eval() and the Function() constructor

To explain: eval() and the Function() constructor are not allowed in any secure subset because they allow the execution of arbitrary strings of code, and these strings cannot be statically analyzed.