eslint/docs/src/rules/no-eval.md

   1 ---
   2 title: no-eval
   3 layout: doc
   4 rule_type: suggestion
   5 related_rules:
   6 - no-implied-eval
   7 further_reading:
   8 - https://ericlippert.com/2003/11/01/eval-is-evil-part-one/
   9 - https://javascriptweblog.wordpress.com/2010/04/19/how-evil-is-eval/
  10 ---
  11
  12
  13 JavaScript's `eval()` function is potentially dangerous and is often misused. Using `eval()` on untrusted code can open a program up to several different injection attacks. The use of `eval()` in most contexts can be substituted for a better, alternative approach to a problem.
  14
  15 ```js
  16 var obj = { x: "foo" },
  17     key = "x",
  18     value = eval("obj." + key);
  19 ```
  20
  21 ## Rule Details
  22
  23 This rule is aimed at preventing potentially dangerous, unnecessary, and slow code by disallowing the use of the `eval()` function. As such, it will warn whenever the `eval()` function is used.
  24
  25 Examples of **incorrect** code for this rule:
  26
  27 ::: incorrect
  28
  29 ```js
  30 /*eslint no-eval: "error"*/
  31
  32 var obj = { x: "foo" },
  33     key = "x",
  34     value = eval("obj." + key);
  35
  36 (0, eval)("var a = 0");
  37
  38 var foo = eval;
  39 foo("var a = 0");
  40
  41 // This `this` is the global object.
  42 this.eval("var a = 0");
  43 ```
  44
  45 :::
  46
  47 Example of additional **incorrect** code for this rule when `browser` environment is set to `true`:
  48
  49 ::: incorrect
  50
  51 ```js
  52 /*eslint no-eval: "error"*/
  53 /*eslint-env browser*/
  54
  55 window.eval("var a = 0");
  56 ```
  57
  58 :::
  59
  60 Example of additional **incorrect** code for this rule when `node` environment is set to `true`:
  61
  62 ::: incorrect
  63
  64 ```js
  65 /*eslint no-eval: "error"*/
  66 /*eslint-env node*/
  67
  68 global.eval("var a = 0");
  69 ```
  70
  71 :::
  72
  73 Examples of **correct** code for this rule:
  74
  75 ::: correct
  76
  77 ```js
  78 /*eslint no-eval: "error"*/
  79 /*eslint-env es6*/
  80
  81 var obj = { x: "foo" },
  82     key = "x",
  83     value = obj[key];
  84
  85 class A {
  86     foo() {
  87         // This is a user-defined method.
  88         this.eval("var a = 0");
  89     }
  90
  91     eval() {
  92     }
  93
  94     static {
  95         // This is a user-defined static method.
  96         this.eval("var a = 0");
  97     }
  98
  99     static eval() {
 100     }
 101 }
 102 ```
 103
 104 :::
 105
 106 ## Options
 107
 108 This rule has an option to allow indirect calls to `eval`.
 109 Indirect calls to `eval` are less dangerous than direct calls to `eval` because they cannot dynamically change the scope. Because of this, they also will not negatively impact performance to the degree of direct `eval`.
 110
 111 ```js
 112 {
 113     "no-eval": ["error", {"allowIndirect": true}] // default is false
 114 }
 115 ```
 116
 117 Example of **incorrect** code for this rule with the `{"allowIndirect": true}` option:
 118
 119 ::: incorrect
 120
 121 ```js
 122 /*eslint no-eval: "error"*/
 123
 124 var obj = { x: "foo" },
 125     key = "x",
 126     value = eval("obj." + key);
 127 ```
 128
 129 :::
 130
 131 Examples of **correct** code for this rule with the `{"allowIndirect": true}` option:
 132
 133 ::: correct
 134
 135 ```js
 136 /*eslint no-eval: "error"*/
 137
 138 (0, eval)("var a = 0");
 139
 140 var foo = eval;
 141 foo("var a = 0");
 142
 143 this.eval("var a = 0");
 144 ```
 145
 146 :::
 147
 148 ::: correct
 149
 150 ```js
 151 /*eslint no-eval: "error"*/
 152 /*eslint-env browser*/
 153
 154 window.eval("var a = 0");
 155 ```
 156
 157 :::
 158
 159 ::: correct
 160
 161 ```js
 162 /*eslint no-eval: "error"*/
 163 /*eslint-env node*/
 164
 165 global.eval("var a = 0");
 166 ```
 167
 168 :::
 169
 170 ## Known Limitations
 171
 172 * This rule is warning every `eval()` even if the `eval` is not global's.
 173   This behavior is in order to detect calls of direct `eval`. Such as:
 174
 175   ```js
 176   module.exports = function(eval) {
 177       // If the value of this `eval` is built-in `eval` function, this is a
 178       // call of direct `eval`.
 179       eval("var a = 0");
 180   };
 181   ```
 182
 183 * This rule cannot catch renaming the global object. Such as:
 184
 185   ```js
 186   var foo = window;
 187   foo.eval("var a = 0");
 188   ```