I suppose eval should be blocked?

<!-- Begin snippet: js -->

<!-- language: lang-js -->

    (0,eval)("alert('indirect eval call not blocked')");

    new Function("alert('function constructor not blocked')")();

<!-- end snippet -->