Security Issues

[matt-]

This should address the unsafe code in ExpressionStatement / FunctionExpression blocks:

var src = '(function(){console.log(process.pid)})()';

As well as the issue described at #4. The current fix for this is to not all any member expressions to resolve from a function.

[1,2,3].map // will be allowed
[1,2,3].map.constructor // should be blocked

I believe the next step should be to try to refactor out the dynamic Function call completely.

[substack]

Thanks for the patch. I've released this as 2.0.0 because there are some package such as static-module that break with these changes.