clarify whether csp blocks reflection of non-string arguments to eval

[jeisinger]

e.g. should eval(1) return 1 or throw an exception?

[mikewest]

I think the spec defers to ECMAScript's call to HostEnsureCanCompileStrings in https://tc39.github.io/ecma262/#sec-function-calls-runtime-semantics-evaluation, which (I think) punts if the argument isn't a string? Maybe? So, I think we're technically correct alrerady, which is best correct.

We should probably add a note to the list of APIs governed by 'unsafe-eval' to carve out only string-based eval.

[domenic]

There's no punting. HostEnsureCanCompileStrings doesn't get to inspect its argument. So it should block it regardless.

This would be a great web platform test for someone to write. If we find all browsers don't have CSP block eval of non-strings, then we should consider updating the spec infrastructure, probably by updating ES to not call HostEnsureCanCompileStrings in such cases.

[mikesamuel]

tc39/ecma262#1504 would fix this.