Attack: escape to Function() and read document.cookie

result:

Controls: benign Object methods must still work

keys:
values:
entries:
assign: