{"record":{"id":"573460d9710e4724","repo":"oxc-project/oxc","slug":"implied-eval-consider-passing-a-function-instead","errorCode":null,"errorMessage":"Implied eval. Consider passing a function instead of a string.","messagePattern":"Implied eval\\. Consider passing a function instead of a string\\.","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"crates/oxc_linter/src/rules/eslint/no_implied_eval.rs","lineNumber":14,"sourceCode":"use oxc_ast::{\n    AstKind,\n    ast::{Argument, CallExpression, Expression, IdentifierReference, MemberExpression},\n};\nuse oxc_diagnostics::OxcDiagnostic;\nuse oxc_macros::declare_oxc_lint;\nuse oxc_semantic::IsGlobalReference;\nuse oxc_span::Span;\nuse oxc_syntax::operator::{BinaryOperator, UnaryOperator};\n\nuse crate::{AstNode, config::GlobalValue, context::LintContext, rule::Rule};\n\nfn implied_eval_diagnostic(span: Span) -> OxcDiagnostic {\n    OxcDiagnostic::warn(\"Implied eval. Consider passing a function instead of a string.\")\n        .with_help(\"Pass a function callback instead of source text.\")\n        .with_label(span)\n}\n\nfn exec_script_diagnostic(span: Span) -> OxcDiagnostic {\n    OxcDiagnostic::warn(\"Implied eval. Do not use execScript().\")\n        .with_help(\"Avoid executing source text at runtime.\")\n        .with_label(span)\n}\n\n#[derive(Debug, Default, Clone)]\npub struct NoImpliedEval;\n\ndeclare_oxc_lint!(\n    /// ### What it does\n    ///\n    /// Disallows passing strings to `setTimeout()`, `setInterval()`, and\n    /// `execScript()`.","sourceCodeStart":1,"sourceCodeEnd":32,"githubUrl":"https://github.com/oxc-project/oxc/blob/e1e7af627c8843ab64044ed466b128fcc21a035b/crates/oxc_linter/src/rules/eslint/no_implied_eval.rs#L1-L32","documentation":"Diagnostic from oxlint's no-implied-eval rule. Calling setTimeout or setInterval with a string first argument behaves like eval: the string is compiled as code at runtime, enabling injection and defeating JIT optimization. The rule reports 'Implied eval. Consider passing a function instead of a string.', including concatenated or computed strings like setTimeout('run(' + id + ')', 0), after verifying the callee resolves to the global timer function.","triggerScenarios":"setTimeout('doLogin()', 100);; setInterval(\"tick()\", 1000);; setTimeout('refresh(' + id + ')', 500);; timer handlers built from server-provided strings.","commonSituations":"Legacy scheduling code from pre-ES5-era tutorials; dynamic handler names delivered by config or an API; security reviews that switch the rule on for the first time.","solutions":["Pass a function: setTimeout(() => doLogin(), 100) or setTimeout(doLogin, 100).","When the call name comes from data, dispatch through a lookup map instead of composing a string.","If truly unavoidable in a sandboxed legacy file, suppress with // oxlint-disable-next-line eslint/no-implied-eval."],"exampleFix":"// before\nsetTimeout('refresh(' + id + ')', 500);\n\n// after\nsetTimeout(() => refresh(id), 500);","handlingStrategy":"validation","validationCode":"const stringTimer = /(?:setTimeout|setInterval)\\s*\\(\\s*['\\\"`]/.test(source);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always pass functions or closures to setTimeout/setInterval.","Map dynamic handler names through a lookup object instead of composing strings.","Treat any string argument to a timer as a security smell in review."],"tags":["eslint","oxlint","lint","security","eval","timers"],"backgroundTag":"implied-eval","analyzedSha":"e1e7af627c8843ab64044ed466b128fcc21a035b","analyzedAt":"2026-08-20T07:01:07.079Z","contentChangedAt":"2026-08-20T07:01:07.079Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}