Can anyone browsing the site help me rewrite this old webapp function to be a bit more secure?

    $('table.dataTable.json-data').each(function() {
      console.log("dataTable function thing called");
      var oTable = $(this).css('visibility', 'visible');
      var dt_config = oTable.is('[data-dt_config]')? eval('('+oTable.attr('data-dt_config')+')') : {};
      if(oTable.is('[data-dt_settings]')) {
        $.extend(true,dt_config,oTable.data('dt_settings'));
      }

So, for context, this Javascript function is called when a user wants to print or export a datatable they have displayed on a page. It generates a new page with the table, and a print menu comes down (or your document is automatically downloaded by your browser).

My client insists that data-dt_config can be checked before running in eval() to prevent injection, but I genuinely don't even want to use eval() at all.

I've been getting much better with perl and php, but Javascript is still out of my element. Please, feel free to explain it to me like I eat crayons, because I'd like to use this post as a good learning opportunity for understanding Javascript more, especially in terms of secure coding.

Object
buttons: Array(3)
0: {extend: 'csv'}
1: {extend: 'pdf', orientation: 'landscape'}
2: {extend: 'print', customize: ƒ}
length: 3
[[Prototype]]: Array(0)
columns: (8) [{…}, {…}, {…}, {…}, {…}, {…}, {…}, {…}]
createdRow: ƒ (row,data,dataIndex)
filename: "Material deduction history"
lengthMenu: (2) [Array(4), Array(4)]
source: "material/1007199/history"
[[Prototype]]: Object

This is the contents of the dt_config variable. It seems to literally just be a set of instruction to make the datatable.

This is the bandaid fix I threw in:
let tempConfig = oTable.attr('data-dt_config');

let testResult = tempConfig.includes("buttons","orientation","customize");

I still think that would be extremely easy to bypass, so I'm researching something better. Some wisdom on this would be great.