fix(runtime/js/timers): Use (0, eval) instead of eval() (#10103)

2 files changed, 23 insertions, 0 deletions

diff --git a/cli/tests/unit/test_util.ts b/cli/tests/unit/test_util.ts
index 39866c3fc..0f967c0fb 100644
--- a/cli/tests/unit/test_util.ts
+++ b/cli/tests/unit/test_util.ts
@@ -21,6 +21,7 @@ export {
   unreachable,
 } from "../../../test_util/std/testing/asserts.ts";
 export { deferred } from "../../../test_util/std/async/deferred.ts";
+export type { Deferred } from "../../../test_util/std/async/deferred.ts";
 export { readLines } from "../../../test_util/std/io/bufio.ts";
 export { parse as parseArgs } from "../../../test_util/std/flags/mod.ts";
 
diff --git a/cli/tests/unit/timers_test.ts b/cli/tests/unit/timers_test.ts
index 11698b3c3..f04793afe 100644
--- a/cli/tests/unit/timers_test.ts
+++ b/cli/tests/unit/timers_test.ts
@@ -3,6 +3,7 @@ import {
   assert,
   assertEquals,
   assertNotEquals,
+  Deferred,
   deferred,
   unitTest,
 } from "./test_util.ts";
@@ -64,6 +65,27 @@ unitTest(async function timeoutSuccess(): Promise<void> {
   assertEquals(count, 1);
 });
 
+unitTest(async function timeoutEvalNoScopeLeak(): Promise<void> {
+  // eval can only access global scope
+  const global = globalThis as unknown as {
+    globalPromise: Deferred<Error>;
+  };
+  global.globalPromise = deferred();
+  setTimeout(
+    `
+    try {
+      console.log(core);
+      globalThis.globalPromise.reject(new Error("Didn't throw."));
+    } catch (error) {
+      globalThis.globalPromise.resolve(error);
+    }` as unknown as () => void,
+    0,
+  );
+  const error = await global.globalPromise;
+  assertEquals(error.name, "ReferenceError");
+  Reflect.deleteProperty(global, "globalPromise");
+});
+
 unitTest(async function timeoutArgs(): Promise<void> {
   const promise = deferred();
   const arg = 1;