js: Forbid eval
js: use vm.runInContext instead of eval