The current design is better than looking for "jaz_zer" substring in the source text for eval()/Function(). However, I think that only checking the getter can still produce false positives. For example, the following code snippet would trigger the RCE bug detector without eval()/Function() being involved.

const propertyName = "jaz_zer";
void globalThis[propertyName];
console.log("can be called just fine");

I think that the current “if anything reads globalThis.jaz_zer, report RCE.” check is too borad. How about we create a cannary call, e.g., jaz_zer() and guide fuzzing to generate such calls as arguments for eval() or Function(). Calling this function can then report an RCE bug.

I think we should make it configurable and allow both (as in either or) defaulting to the current implementation that marks access as RCE.

And the reasoning is that it is:

1. very unusual if something accesses globalThis["jaz_zer"]
2. the actuall execution might happen later, behind some fuzzing blocker. E.g.:

var fn = eval(my_awesome_sanitizer("..."));
...
 // much later, after lots of fuzzing
fn(); // actual call

In case it's a false-positive, the users can be informed that it's possible to switch to a more strict RCE detection that requires an actual canary execution.
WDYT?