{"record":{"id":"ce5b37535e09d8ee","repo":"oxc-project/oxc","slug":"using-new-function-or-function-is-not-allowed","errorCode":null,"errorMessage":"Using `new Function` or `Function` is not allowed.","messagePattern":"Using `new Function` or `Function` is not allowed\\.","errorType":"validation","errorClass":"OxcDiagnostic","httpStatus":null,"severity":"error","filePath":"crates/oxc_linter/src/rules/eslint/no_new_func.rs","lineNumber":14,"sourceCode":"use oxc_ast::{\n    AstKind,\n    ast::{Expression, IdentifierReference, MemberExpression},\n};\nuse oxc_diagnostics::OxcDiagnostic;\nuse oxc_macros::declare_oxc_lint;\nuse oxc_semantic::IsGlobalReference;\nuse oxc_span::Span;\nuse oxc_str::static_ident;\n\nuse crate::{AstNode, context::LintContext, rule::Rule};\n\nfn no_new_func(function_call_span: Span, arguments_span: Option<Span>) -> OxcDiagnostic {\n    let mut diagnostic = OxcDiagnostic::warn(\"Using `new Function` or `Function` is not allowed.\")\n        .with_help(\n            \"Avoid the `Function` constructor. Define the function directly with a function declaration/expression or an arrow function.\",\n        )\n        .with_note(\n            \"The `Function` constructor compiles code from strings at runtime, which can introduce injection risks, hurts performance, and makes code harder to analyze and maintain.\",\n        )\n        .with_label(function_call_span.primary_label(\"Dynamic function construction is used here.\"));\n\n    if let Some(arguments_span) = arguments_span {\n        diagnostic = diagnostic.and_label(\n            arguments_span.label(\"`Function` evaluates source text at runtime, similar to `eval`.\"),\n        );\n    }\n    diagnostic\n}\n\n#[derive(Debug, Default, Clone)]\npub struct NoNewFunc;","sourceCodeStart":1,"sourceCodeEnd":32,"githubUrl":"https://github.com/oxc-project/oxc/blob/e1e7af627c8843ab64044ed466b128fcc21a035b/crates/oxc_linter/src/rules/eslint/no_new_func.rs#L1-L32","documentation":"Lint diagnostic from eslint/no-new-func: the Function constructor (via new Function(...) or a bare Function(...) call to the global) was detected. It evaluates a string as code at runtime with global scope, which is eval-like, breaks CSP, and defeats tooling/static analysis.","triggerScenarios":"Thrown at crates/oxc_linter/src/rules/eslint/no_new_func.rs:14 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Define the function directly with a function expression or arrow function","Build behavior with closures over data instead of strings"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"e1e7af627c8843ab64044ed466b128fcc21a035b","analyzedAt":"2026-08-20T07:01:07.079Z","contentChangedAt":"2026-08-20T07:01:07.079Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}