fix(runtime/js/timers): Use (0, eval) instead of eval() (#10103)

cli/tests/unit/test_util.ts

@@ -21,6 +21,7 @@ export {
   unreachable,
 } from "../../../test_util/std/testing/asserts.ts";
 export { deferred } from "../../../test_util/std/async/deferred.ts";
+export type { Deferred } from "../../../test_util/std/async/deferred.ts";
 export { readLines } from "../../../test_util/std/io/bufio.ts";
 export { parse as parseArgs } from "../../../test_util/std/flags/mod.ts";
 

cli/tests/unit/timers_test.ts

@@ -3,6 +3,7 @@ import {
   assert,
   assertEquals,
   assertNotEquals,
+  Deferred,
   deferred,
   unitTest,
 } from "./test_util.ts";
@@ -64,6 +65,27 @@ unitTest(async function timeoutSuccess(): Promise<void> {
   assertEquals(count, 1);
 });
 
+unitTest(async function timeoutEvalNoScopeLeak(): Promise<void> {
+  // eval can only access global scope
+  const global = globalThis as unknown as {
+    globalPromise: Deferred<Error>;
+  };
+  global.globalPromise = deferred();
+  setTimeout(
+    `
+    try {
+      console.log(core);
+      globalThis.globalPromise.reject(new Error("Didn't throw."));
+    } catch (error) {
+      globalThis.globalPromise.resolve(error);
+    }` as unknown as () => void,
+    0,
+  );
+  const error = await global.globalPromise;
+  assertEquals(error.name, "ReferenceError");
+  Reflect.deleteProperty(global, "globalPromise");
+});
+
 unitTest(async function timeoutArgs(): Promise<void> {
   const promise = deferred();
   const arg = 1;

runtime/js/11_timers.js

@@ -442,7 +442,7 @@
     if ("function" === typeof callback) {
       callback();
     } else {
-      eval(callback);
+      (0, eval)(callback);
     }
   }