{"record":{"id":"1415f6072a7278ca","repo":"oxc-project/oxc","slug":"implied-eval-do-not-use-execscript","errorCode":null,"errorMessage":"Implied eval. Do not use execScript().","messagePattern":"Implied eval\\. Do not use execScript\\(\\)\\.","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"crates/oxc_linter/src/rules/eslint/no_implied_eval.rs","lineNumber":20,"sourceCode":"    AstKind,\n    ast::{Argument, CallExpression, Expression, IdentifierReference, MemberExpression},\n};\nuse oxc_diagnostics::OxcDiagnostic;\nuse oxc_macros::declare_oxc_lint;\nuse oxc_semantic::IsGlobalReference;\nuse oxc_span::Span;\nuse oxc_syntax::operator::{BinaryOperator, UnaryOperator};\n\nuse crate::{AstNode, config::GlobalValue, context::LintContext, rule::Rule};\n\nfn implied_eval_diagnostic(span: Span) -> OxcDiagnostic {\n    OxcDiagnostic::warn(\"Implied eval. Consider passing a function instead of a string.\")\n        .with_help(\"Pass a function callback instead of source text.\")\n        .with_label(span)\n}\n\nfn exec_script_diagnostic(span: Span) -> OxcDiagnostic {\n    OxcDiagnostic::warn(\"Implied eval. Do not use execScript().\")\n        .with_help(\"Avoid executing source text at runtime.\")\n        .with_label(span)\n}\n\n#[derive(Debug, Default, Clone)]\npub struct NoImpliedEval;\n\ndeclare_oxc_lint!(\n    /// ### What it does\n    ///\n    /// Disallows passing strings to `setTimeout()`, `setInterval()`, and\n    /// `execScript()`.\n    ///\n    /// ### Why is this bad?\n    ///\n    /// Passing a string to these APIs evaluates the string as JavaScript source\n    /// text at runtime. This has many of the same security, readability, and\n    /// performance problems as `eval()`. Pass a function instead.","sourceCodeStart":2,"sourceCodeEnd":38,"githubUrl":"https://github.com/oxc-project/oxc/blob/e1e7af627c8843ab64044ed466b128fcc21a035b/crates/oxc_linter/src/rules/eslint/no_implied_eval.rs#L2-L38","documentation":"The execScript variant of oxlint's no-implied-eval rule. execScript() is the legacy Internet Explorer counterpart of eval and always compiles and executes a string as code. The rule reports any call to the global execScript with 'Implied eval. Do not use execScript().' because no safe static use exists.","triggerScenarios":"execScript('alert(1)');; window.execScript(code) inside IE compatibility shims; copy-paste from old MSDN-era samples.","commonSituations":"IE-era compatibility layers still living in bundles; enterprise code that once supported IE8; ancient forum answers reused as utilities.","solutions":["Delete the IE shim: execScript does not exist in modern browsers and the call throws.","Replace dynamic code strings with direct function calls.","If dynamic evaluation is genuinely required, isolate it in a reviewed sandbox module and suppress the line explicitly."],"exampleFix":"// before\nexecScript('doSetup()');\n\n// after\ndoSetup();","handlingStrategy":"validation","validationCode":"const execScriptCall = /\\bexecScript\\s*\\(/.test(source);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Remove execScript calls; modern browsers do not implement it.","Replace dynamic code strings with function references.","Keep legacy IE shims out of linted source trees."],"tags":["eslint","oxlint","lint","security","eval","legacy"],"backgroundTag":"implied-eval","analyzedSha":"e1e7af627c8843ab64044ed466b128fcc21a035b","analyzedAt":"2026-08-20T07:01:07.079Z","contentChangedAt":"2026-08-20T07:01:07.079Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}