Facebook Security Hole #2

When sandboxing JavaScript code, it is crucial that FBJS prevents the execution of arbitrary, unparsed code. The problem is that JavaScript provides many ways to do that. Between eval(), new Function(), or even setTimeout() (as we saw in my last post) there are many ways for a hacker to dynamically inject arbitrary code in the JavaScript language.

The way Facebook prevents access to these code-i...