Restrict application of eval so it can only be used in the context of the glo...

test/cctest/test-api.cc

 // Copyright 2007-2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 4060 matching lines @@
   CHECK(result->IsBoolean());
   CHECK(result->BooleanValue());
 
   // Check that doing a cross eval works from within a global
   // with-statement.
   script =
       Script::Compile(v8_str("other.y = 1;"
                                       "with({x:2}){other.eval('x+y')}"));
   result = script->Run();
   CHECK_EQ(3, result->Int32Value());
+
+  // Check that you cannot use 'eval.call' with another object than the
+  // current global object.
+  v8::TryCatch try_catch;
+  script =
+      Script::Compile(v8_str("other.y = 1; eval.call(other, 'y')"));
+  result = script->Run();
+  CHECK(try_catch.HasCaught());
 }
 
 
 THREADED_TEST(CrossLazyLoad) {
   v8::HandleScope scope;
   LocalContext other;
   LocalContext current;
 
   Local<String> token = v8_str("<security token>");
   other->SetSecurityToken(token);
@@ skipping 1116 matching lines @@
   LocalContext context;
   Local<ObjectTemplate> templ = ObjectTemplate::New();
   templ->SetAccessCheckCallbacks(NamedSetAccessBlocker,
                                  IndexedSetAccessBlocker);
   templ->Set(v8_str("x"), v8::True());
   Local<v8::Object> instance = templ->NewInstance();
   context->Global()->Set(v8_str("obj"), instance);
   Local<Value> value = CompileRun("obj.x");
   CHECK(value->BooleanValue());
 }