In JavaScript, "Functions created with the Function constructor do not create closures to their creation contexts; they always are created in the global scope. When running them, they will only be able to access their own local variables and global ones, not the ones from the scope in which the Function constructor was called", per MDN. This is not true in JavaScript, and this inconsistence is being exploited "in the wild" as seen in this sample.
MDN reports that this does not happen for eval with code for a function expression, so it's worth looking into as a possible way to implement this quirk in a rather clean way.
In JavaScript, "Functions created with the Function constructor do not create closures to their creation contexts; they always are created in the global scope. When running them, they will only be able to access their own local variables and global ones, not the ones from the scope in which the Function constructor was called", per MDN. This is not true in JavaScript, and this inconsistence is being exploited "in the wild" as seen in this sample.
MDN reports that this does not happen for
evalwith code for a function expression, so it's worth looking into as a possible way to implement this quirk in a rather clean way.