codeql/javascript/ql/test/query-tests/Security/CWE-094/UnsafeDynamicMethodAccess/example.js

// API methods
function play(data) {
  // ...
}
function pause(data) {
  // ...
}

window.addEventListener("message", (ev) => {
    let message = JSON.parse(ev.data);

    // Let the parent frame call the 'play' or 'pause' function 
    window[message.name](message.payload); // NOT OK
});