Update: no-new-func rule catching eval case of MemberExpression

docs/rules/no-new-func.md

@@ -1,12 +1,16 @@
 # Disallow Function Constructor (no-new-func)
 
-It's possible to create functions in JavaScript using the `Function` constructor, such as:
+It's possible to create functions in JavaScript from strings at runtime using `Function` constructors, such as:
 
 ```js
 var x = new Function("a", "b", "return a + b");
+var x = Function("a", "b", "return a + b");
+var x = Function.call(null, "a", "b", "return a + b");
+var x = Function.apply(null, ["a", "b", "return a + b"]);
+var x = Function.bind(null, "a", "b", "return a + b")();
 ```
 
-This is considered by many to be a bad practice due to the difficulty in debugging and reading these types of functions.
+This is considered by many to be a bad practice due to the difficulty in debugging and reading these types of functions. In addition, Content-Security-Policy (CSP) directives may disallow the use of eval() and similar methods for creating code from strings.
 
 ## Rule Details
 
@@ -19,6 +23,9 @@ Examples of **incorrect** code for this rule:
 
 var x = new Function("a", "b", "return a + b");
 var x = Function("a", "b", "return a + b");
+var x = Function.call(null, "a", "b", "return a + b");
+var x = Function.apply(null, ["a", "b", "return a + b"]);
+var x = Function.bind(null, "a", "b", "return a + b")();
 ```
 
 Examples of **correct** code for this rule:

lib/rules/no-new-func.js

@@ -38,12 +38,24 @@ module.exports = {
                     variable.references.forEach(ref => {
                         const node = ref.identifier;
                         const { parent } = node;
+                        let isEval = false;
 
-                        if (
-                            parent &&
-                            (parent.type === "NewExpression" || parent.type === "CallExpression") &&
-                            node === parent.callee
-                        ) {
+                        if (parent) {
+                            if (node === parent.callee && (
+                                parent.type === "NewExpression" ||
+                                parent.type === "CallExpression"
+                            )) {
+                                isEval = true;
+                            } else if (parent.type === "MemberExpression") {
+                                const gParent = parent.parent;
+
+                                if (gParent && gParent.type === "CallExpression") {
+                                    isEval = true;
+                                }
+                            }
+                        }
+
+                        if (isEval) {
                             context.report({
                                 node: parent,
                                 messageId: "noFunctionConstructor"

tests/lib/rules/no-new-func.js

@@ -55,6 +55,27 @@ ruleTester.run("no-new-func", rule, {
                 type: "CallExpression"
             }]
         },
+        {
+            code: "var a = Function.call(null, \"b\", \"c\", \"return b+c\");",
+            errors: [{
+                messageId: "noFunctionConstructor",
+                type: "MemberExpression"
+            }]
+        },
+        {
+            code: "var a = Function.apply(null, [\"b\", \"c\", \"return b+c\"]);",
+            errors: [{
+                messageId: "noFunctionConstructor",
+                type: "MemberExpression"
+            }]
+        },
+        {
+            code: "var a = Function.bind(null, \"b\", \"c\", \"return b+c\")();",
+            errors: [{
+                messageId: "noFunctionConstructor",
+                type: "MemberExpression"
+            }]
+        },
         {
             code: "const fn = () => { class Function {} }; new Function('', '')",
             parserOptions: {