transformObject(obj, query) { const __SECRET_FUNCTION = () => console.log("kaboom! "); const transform = new Function("obj", `return (${query});`); return transform(obj); } const data = { a: 2, b: 3 }; console.log( transformObject(data, "{ a: obj.a * 2, b: obj.b * 2 }") // => `{ a: 4, b: 6 }` ); console.log( transformObject(data, "__SECRET_FUNCTION()") // => `Uncaught ReferenceError: __SECRET_FUNCTION is not defined` );