{"record":{"id":"12871c65fa6b6d6d","repo":"oxc-project/oxc","slug":"eval-can-be-harmful","errorCode":null,"errorMessage":"eval can be harmful.","messagePattern":"eval can be harmful\\.","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"crates/oxc_linter/src/rules/eslint/no_eval.rs","lineNumber":17,"sourceCode":"use oxc_ast::AstKind;\nuse oxc_diagnostics::OxcDiagnostic;\nuse oxc_macros::declare_oxc_lint;\nuse oxc_span::{GetSpan, Span};\nuse schemars::JsonSchema;\nuse serde::Deserialize;\n\nuse crate::{\n    AstNode,\n    ast_util::{self},\n    config::GlobalValue,\n    context::LintContext,\n    rule::{DefaultRuleConfig, Rule},\n};\n\nfn no_eval_diagnostic(span: Span) -> OxcDiagnostic {\n    OxcDiagnostic::warn(\"eval can be harmful.\")\n        .with_help(\"Avoid eval(). For JSON parsing use JSON.parse(); for dynamic property access use bracket notation (obj[key]); for other cases refactor to avoid evaluating strings as code.\")\n        .with_label(span)\n}\n\n#[derive(Debug, Default, Clone, JsonSchema, Deserialize)]\n#[serde(rename_all = \"camelCase\", default, deny_unknown_fields)]\npub struct NoEval {\n    /// This `allowIndirect` option allows indirect `eval()` calls.\n    ///\n    /// Indirect calls to `eval`(e.g., `window['eval']`) are less dangerous\n    /// than direct calls because they cannot dynamically change the scope.\n    /// Indirect `eval()` calls also typically have less impact on performance\n    /// compared to direct calls, as they do not invoke JavaScript's scope chain.\n    allow_indirect: bool,\n}\n\ndeclare_oxc_lint!(\n    /// ### What it does","sourceCodeStart":1,"sourceCodeEnd":35,"githubUrl":"https://github.com/oxc-project/oxc/blob/e1e7af627c8843ab64044ed466b128fcc21a035b/crates/oxc_linter/src/rules/eslint/no_eval.rs#L1-L35","documentation":"This diagnostic comes from the `no_eval` rule in oxlint. It reports references to `eval`, because `eval()` runs a string as code: it can execute injected input, blocks engine optimization, and breaks scope rules. Direct calls, aliases such as `const foo = eval; foo(code)`, and indirect forms like `(0, eval)(code)` or `window.eval(code)` are reported. The option `allowIndirect` (default `false`) stops reports on the indirect forms when set to `true`; a local or member `eval` that shadows the global is not reported.","triggerScenarios":"A direct call `eval(userInput)`. An alias `const foo = eval;` followed by `foo(code)`. An indirect call `(0, eval)(code)` or `this.eval(code)` in non-class code, reported while `allowIndirect` is `false`. The rule checks root unresolved references to the `eval`, `global`, `window`, and `globalThis` globals.","commonSituations":"Legacy code evaluates JSON or templates received from a server. Dynamic expression filters are copied from old examples. A security review turns the rule on, and old code lights up in CI.","solutions":["Replace eval of JSON text with `JSON.parse`.","Replace dynamic member access with bracket notation: `obj[key]` instead of `eval('obj.' + key)`.","For real code generation, use `new Function(...)` with strict inputs, or a small expression library.","Set `\"allowIndirect\": true` for intentional indirect eval, or disable per line with `// oxlint-disable-next-line no-eval`."],"exampleFix":"// before\nconst data = eval('(' + serverJson + ')');\n\n// after\nconst data = JSON.parse(serverJson);","handlingStrategy":"validation","validationCode":"// reject any eval reference before lint\nif (/\\beval\\s*\\(/.test(src) || /\\beval\\b/.test(src)) throw new Error('eval reference found');","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Treat each eval as a security review item; log and justify it.","Use JSON.parse for data and bracket access for lookups.","Serve a CSP header without 'unsafe-eval' so the browser blocks it too."],"tags":["javascript","eslint","lint","security","eval"],"backgroundTag":"lint-eval-usage","analyzedSha":"e1e7af627c8843ab64044ed466b128fcc21a035b","analyzedAt":"2026-08-20T07:01:07.079Z","contentChangedAt":"2026-08-20T07:01:07.079Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}