eslint/lib/rules/no-new-func.js

   1 /**
   2  * @fileoverview Rule to flag when using new Function
   3  * @author Ilya Volodin
   4  */
   5
   6 "use strict";
   7
   8 //------------------------------------------------------------------------------
   9 // Requirements
  10 //------------------------------------------------------------------------------
  11
  12 const astUtils = require("./utils/ast-utils");
  13
  14 //------------------------------------------------------------------------------
  15 // Helpers
  16 //------------------------------------------------------------------------------
  17
  18 const callMethods = new Set(["apply", "bind", "call"]);
  19
  20 //------------------------------------------------------------------------------
  21 // Rule Definition
  22 //------------------------------------------------------------------------------
  23
  24 module.exports = {
  25     meta: {
  26         type: "suggestion",
  27
  28         docs: {
  29             description: "disallow `new` operators with the `Function` object",
  30             recommended: false,
  31             url: "https://eslint.org/docs/rules/no-new-func"
  32         },
  33
  34         schema: [],
  35
  36         messages: {
  37             noFunctionConstructor: "The Function constructor is eval."
  38         }
  39     },
  40
  41     create(context) {
  42
  43         return {
  44             "Program:exit"() {
  45                 const globalScope = context.getScope();
  46                 const variable = globalScope.set.get("Function");
  47
  48                 if (variable && variable.defs.length === 0) {
  49                     variable.references.forEach(ref => {
  50                         const node = ref.identifier;
  51                         const { parent } = node;
  52                         let evalNode;
  53
  54                         if (parent) {
  55                             if (node === parent.callee && (
  56                                 parent.type === "NewExpression" ||
  57                                 parent.type === "CallExpression"
  58                             )) {
  59                                 evalNode = parent;
  60                             } else if (
  61                                 parent.type === "MemberExpression" &&
  62                                 node === parent.object &&
  63                                 callMethods.has(astUtils.getStaticPropertyName(parent))
  64                             ) {
  65                                 const maybeCallee = parent.parent.type === "ChainExpression" ? parent.parent : parent;
  66
  67                                 if (maybeCallee.parent.type === "CallExpression" && maybeCallee.parent.callee === maybeCallee) {
  68                                     evalNode = maybeCallee.parent;
  69                                 }
  70                             }
  71                         }
  72
  73                         if (evalNode) {
  74                             context.report({
  75                                 node: evalNode,
  76                                 messageId: "noFunctionConstructor"
  77                             });
  78                         }
  79                     });
  80                 }
  81             }
  82         };
  83
  84     }
  85 };