I have an application which lets clients eval() their code but I don't what that they make any kind of call to server(ajax).
1 Answer
First, you probably shouldn't let clients eval code.
Second, even if you put some most sophisticated javascript filters in your app, that's not gonna prevent anything. A user can run any javascript in the console, and there's nothing you can do about it. Except for placing checks on server-side.
eval()altogether.