createSecureScript.js

const trusted = [],
    untrusted = [
        'eval',
        ...Object.keys(window)
    ].filter(k => trusted.indexOf(k) !== -1);

export default function createSecureScript(script, ...args) {
    return new Function(
        ...untrusted,
        ...args,
        `return ${script}`
    ).bind(undefined, ...Array(untrusted.length))
}