fix(core): Prevent arbitrary code execution via expressions (#6420)

packages/workflow/test/Expression.test.ts

@@ -150,6 +150,13 @@ describe('Expression', () => {
 			expect(evaluate('={{Boolean(1)}}')).toEqual(Boolean(1));
 			expect(evaluate('={{Symbol(1).toString()}}')).toEqual(Symbol(1).toString());
 		});
+
+		it('should not able to do arbitrary code execution', () => {
+			const testFn = jest.fn();
+			Object.assign(global, { testFn });
+			evaluate("={{ Date['constructor']('testFn()')()}}");
+			expect(testFn).not.toHaveBeenCalled();
+		});
 	});
 
 	describe('Test all expression value fixtures', () => {