implement sandbox for eval