@@ -60,15 +60,17 @@ export class JitEvaluator {
   evaluateCode(
     sourceUrl: string,
     ctx: EmitterVisitorContext,
-    vars: {[key: string]: any},
+    vars: Record<string, any>,
     createSourceMap: boolean,
   ): any {
     let fnBody = `"use strict";${ctx.toSource()}\n//# sourceURL=${sourceUrl}`;
     const fnArgNames: string[] = [];
     const fnArgValues: any[] = [];
     for (const argName in vars) {
-      fnArgValues.push(vars[argName]);
-      fnArgNames.push(argName);
+      if (Object.hasOwn(vars, argName)) {
+        fnArgValues.push(vars[argName]);
+        fnArgNames.push(argName);
+      }
     }
     if (createSourceMap) {
       // using `new Function(...)` generates a header, 1 line of no arguments, 2 lines otherwise
 
@@ -95,6 +95,8 @@ function trustedScriptFromString(script: string): TrustedScript | string {
   return getPolicy()?.createScript(script) || script;
 }
 
+const PARAM_NAME_PATTERN = /^[A-Za-z_$][\w$]*$/;
+
 /**
  * Unsafely call the Function constructor with the given string arguments.
  * @security This is a security-sensitive function; any use of this function
@@ -113,9 +115,16 @@ export function newTrustedFunctionForJIT(...args: string[]): Function {
   // constructor. The following implements the workaround proposed on the page
   // below, where the Chromium bug is also referenced:
   // https://github.com/w3c/webappsec-trusted-types/wiki/Trusted-Types-for-function-constructor
-  const fnArgs = args.slice(0, -1).join(',');
   const fnBody = args[args.length - 1];
-  const body = `(function anonymous(${fnArgs}
+  const fnParams = args.slice(0, -1);
+
+  for (const param of fnParams) {
+    if (!PARAM_NAME_PATTERN.test(param)) {
+      throw new Error(`newTrustedFunctionForJIT: invalid parameter name "${param}"`);
+    }
+  }
+
+  const body = `(function anonymous(${fnParams.join(',')}
 ) { ${fnBody}
 })`;
 
 
@@ -213,10 +213,10 @@ export function identifierName(
     return null;
   }
   const ref = compileIdentifier.reference;
-  if (ref['__anonymousType']) {
+  if (Object.hasOwn(ref, '__anonymousType')) {
     return ref['__anonymousType'];
   }
-  if (ref['__forward_ref__']) {
+  if (Object.hasOwn(ref, '__forward_ref__')) {
     // We do not want to try to stringify a `forwardRef()` function because that would cause the
     // inner function to be evaluated too early, defeating the whole point of the `forwardRef`.
     return '__forward_ref__';
Original file line number	Diff line number	Diff line change
`@@ -213,10 +213,10 @@ export function identifierName(`
`213`	`213`	`return null;`
`214`	`214`	`}`
`215`	`215`	`const ref = compileIdentifier.reference;`
`216`		`- if (ref['__anonymousType']) {`
	`216`	`+ if (Object.hasOwn(ref, '__anonymousType')) {`
`217`	`217`	`return ref['__anonymousType'];`
`218`	`218`	`}`
`219`		`- if (ref['__forward_ref__']) {`
	`219`	`+ if (Object.hasOwn(ref, '__forward_ref__')) {`
`220`	`220`	// We do not want to try to stringify a `forwardRef()` function because that would cause the
`221`	`221`	// inner function to be evaluated too early, defeating the whole point of the `forwardRef`.
`222`	`222`	`return '__forward_ref__';`