5.js

class SandboxGlobalProxy {
  constructor(blacklist) {
    const iframe = document.createElement("iframe", { url: "about:blank" });
    iframe.style.display = "none";
    document.body.appendChild(iframe);

    const sandboxGlobal = iframe.contentWindow;

    return new Proxy(sandboxGlobal, {
      has: (target, prop) => {

        if (blacklist.includes(prop)) {
          throw new Error(`Can't use: ${prop}!`);
        }
        if (!target.hasOwnProperty(prop)) {
          throw new Error(`Not find: ${prop}!`);
        }

        return true;
      }
    });
  }
}

function withedYourCode(code) {
  code = "with(sandbox) {" + code + "}";
  return new Function("sandbox", code);
}

function makeSandbox(code, ctx) {
  withedYourCode(code).call(ctx, ctx);
}

const code = `console.log(document)`;

const blacklist = ['window', 'document', 'XMLHttpRequest', 'fetch', 'WebSocket', 'Image'];

const globalProxy = new SandboxGlobalProxy(blacklist);

makeSandbox(code, globalProxy);