[CB-2653] Remove eval from direct JS injection