Secure Mode exposes 'window' as 'this'

[xsc]

Within the KLIPSE boxes at the blog post announcing secure mode, it's still possible to run e.g. the following Javascript snippets, exposing things secure mode is trying to hide:

this.document
this.eval("1+2")

Even HTTP requests can be triggered:

var makeXhr = this.Function("return new XMLHttpRequest()");
var xhr = makeXhr.call(this);
...

All this is possible because this is bound to window.

[viebel]

Thanks for the bug report.
I'm working on a fix.

[workshub]

@hgupta2363 started working on this issue via WorksHub.