[philsnow]

modern browsers don't internally call eval(). See e.g. the definition of JSON.parse in v8: https://chromium.googlesource.com/v8/v8/+/4.3.65/src/json.js...

[vsl]

And modern XML parsers aren't full of vulnerabilities anymore. You're missing the point.