Code Injection via eval() and Function constructor

Description

Detects user input flowing to code execution functions like eval() or Function constructor.

What Shoulder detects

Dangerous function usage detected: {sink}
Input from {source} allows an attacker to execute arbitrary code
This can lead to Remote Code Execution (RCE) if user input is not properly validated.

How to fix

Use JSON.parse for data or predefined function maps instead of eval().

```javascript
const data = JSON.parse(userInput);
// Or use a function map
const ops = { add: (a,b) => a+b };
ops[action]?.(x, y);
```

Learn more: https://shoulder.dev/learn/javascript/cwe-94/code-injection