noGlobalEval (JavaScript)

Language JavaScript (and super languages)

Summary

Rule available since: v1.5.0
Diagnostic Category: lint/security/noGlobalEval
This rule is recommended, meaning it is enabled by default.
This rule doesn’t have a fix.
The default severity of this rule is error.
Sources:
- Same as no-eval

How to configure

1
{
2
  "linter": {
3
    "rules": {
4
      "security": {
5
        "noGlobalEval": "error"
6
      }
7
    }
8
  }
9
}

Description

Disallow the use of global eval().

The eval() function evaluates the passed string as a JavaScript code. The executed code can access and mutate variables in the scope where the function is called.

The use of eval() exposes to security risks and performance issues. If the executed code is somehow affected by a malicious party, then you may end up executing malicious code with the privileges of the caller. Moreover, changing variables in the caller’s scope is expensive in modern JavaScript interpreters.

Examples

Invalid

1
eval("var a = 0");

code-block.js:1:1 lint/security/noGlobalEval ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  ✖ Do not use eval().
  
  > 1 │ eval("var a = 0");
      │ ^^^^
    2 │ 
  
  ℹ eval() runs code from a string. This exposes the program to security risks, such as code injection, and can cause performance issues.
  
  ℹ See the MDN web docs for more details.
  
  ℹ Refactor the code so that it doesn't need to call eval().

1
(0, globalThis.eval)("var a = 0")

code-block.js:1:5 lint/security/noGlobalEval ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  ✖ Do not use eval().
  
  > 1 │ (0, globalThis.eval)("var a = 0")
      │     ^^^^^^^^^^^^^^^
    2 │ 
  
  ℹ eval() runs code from a string. This exposes the program to security risks, such as code injection, and can cause performance issues.
  
  ℹ See the MDN web docs for more details.
  
  ℹ Refactor the code so that it doesn't need to call eval().

1
f(eval);

code-block.js:1:3 lint/security/noGlobalEval ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  ✖ Do not use eval().
  
  > 1 │ f(eval);
      │   ^^^^
    2 │ 
  
  ℹ eval() runs code from a string. This exposes the program to security risks, such as code injection, and can cause performance issues.
  
  ℹ See the MDN web docs for more details.
  
  ℹ Refactor the code so that it doesn't need to call eval().

1
const aliasedEval = eval;

code-block.js:1:21 lint/security/noGlobalEval ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  ✖ Do not use eval().
  
  > 1 │ const aliasedEval = eval;
      │                     ^^^^
    2 │ 
  
  ℹ eval() runs code from a string. This exposes the program to security risks, such as code injection, and can cause performance issues.
  
  ℹ See the MDN web docs for more details.
  
  ℹ Refactor the code so that it doesn't need to call eval().

Valid

1
function f(eval) {
2
    eval("let a = 0;");
3
}

The rule is not able to detect cases where the global object is aliased:

1
let foo = globalThis;
2
foo.eval("let a = 0;");