use eval() with early throw instead of Function() to prevent script injection

Author: James Halliday

index.js

@@ -4,10 +4,11 @@ module.exports = function (src, file) {
     if (typeof src !== 'string') src = String(src);
 
     try {
-        Function(src);
+        eval('throw "STOP"; (function () { ' + src + '})()');
         return;
     }
     catch (err) {
+        if (err === 'STOP') return undefined;
         if (err.constructor.name !== 'SyntaxError') throw err;
         return errorInfo(src, file);
     }

test/sources/run2.js

@@ -1 +1,3 @@
-}); process.exit(1); (function () {
+})();
+process.exit(1);
+(function () {