Your whitelisting is quite good!

I still haven't been able to do complete code execution yet, but have reasons to believe it might be possible.

Simply using `x1` as input causes it to print "deadbeef11 is not defined". Additionally, parens are allowed, and there is the `=>` arrow syntax for defining functions. Thus, we have a way to define variables, a way to define lambda abstractions, as well as a way to perform applications. Therefore, we have the untyped lambda calculus. This is Turing complete, so I have reason to believe that it should be possible to execute arbitrary code. I just need to find some time to do so :)

Update: `(x1=>x1(x1))(x1=>x1(x1))` gives "Too much recursion" :D

That's a really nice example! Your whitelist is pretty restrictive. I was reminded of JSFuck where simply allowing six characters ( ) + [ ] ! would basically allow everything. Although I have to mention, your whitelist still permits undefined (such as x.x) as well as certain strings (0 + /./)

I'm also pretty sure the Google Closure library originally used whitelist checking + eval to parse JSON before JSON.stringify was a thing.

Generally I always use Function() instead of eval, because Function doesn't capture the current scope (and also it won't interfere with JIT optimisation, and avoids possible memory bloat of variables in closure if you keep references to the functions).

I saw a trick where you just do:

  const eval2 = eval

  eval2(...)

That put’s it back in global scope, even when assigned within a closure with access to a local variable. The local variable will be undefined, rather than it’s actual value, even when called next to the regular eval(). Odd, I know.

Here’s a quote:

"any invocation of eval that is not a direct call uses the global environment as its variable environment rather than the caller’s variable environment." ECMAScript 5 standard,

Looking throught the list of http://www.jsfuck.com a lot of the 'basics' can be created in your environment too.

For example a string can be created like this:

(x=>0)+0

If arbitrary code can be constructed in your environment ... hard to say. But as jaybosamiya has shown, it is at least possible to escape your error handling.