oxc-project/oxc · warning

Implied eval. Do not use execScript().

Error message

Implied eval. Do not use execScript().

What it means

The execScript variant of oxlint's no-implied-eval rule. execScript() is the legacy Internet Explorer counterpart of eval and always compiles and executes a string as code. The rule reports any call to the global execScript with 'Implied eval. Do not use execScript().' because no safe static use exists.

Source

Thrown at crates/oxc_linter/src/rules/eslint/no_implied_eval.rs:20

    AstKind,
    ast::{Argument, CallExpression, Expression, IdentifierReference, MemberExpression},
};
use oxc_diagnostics::OxcDiagnostic;
use oxc_macros::declare_oxc_lint;
use oxc_semantic::IsGlobalReference;
use oxc_span::Span;
use oxc_syntax::operator::{BinaryOperator, UnaryOperator};

use crate::{AstNode, config::GlobalValue, context::LintContext, rule::Rule};

fn implied_eval_diagnostic(span: Span) -> OxcDiagnostic {
    OxcDiagnostic::warn("Implied eval. Consider passing a function instead of a string.")
        .with_help("Pass a function callback instead of source text.")
        .with_label(span)
}

fn exec_script_diagnostic(span: Span) -> OxcDiagnostic {
    OxcDiagnostic::warn("Implied eval. Do not use execScript().")
        .with_help("Avoid executing source text at runtime.")
        .with_label(span)
}

#[derive(Debug, Default, Clone)]
pub struct NoImpliedEval;

declare_oxc_lint!(
    /// ### What it does
    ///
    /// Disallows passing strings to `setTimeout()`, `setInterval()`, and
    /// `execScript()`.
    ///
    /// ### Why is this bad?
    ///
    /// Passing a string to these APIs evaluates the string as JavaScript source
    /// text at runtime. This has many of the same security, readability, and
    /// performance problems as `eval()`. Pass a function instead.

View on GitHub (pinned to e1e7af627c)

Solutions

1. Delete the IE shim: execScript does not exist in modern browsers and the call throws.
2. Replace dynamic code strings with direct function calls.
3. If dynamic evaluation is genuinely required, isolate it in a reviewed sandbox module and suppress the line explicitly.

Example fix

// before
execScript('doSetup()');

// after
doSetup();

const execScriptCall = /\bexecScript\s*\(/.test(source);

When it happens

Trigger: execScript('alert(1)');; window.execScript(code) inside IE compatibility shims; copy-paste from old MSDN-era samples.

Common situations: IE-era compatibility layers still living in bundles; enterprise code that once supported IE8; ancient forum answers reused as utilities.

Related errors

• Implied eval. Consider passing a function instead of a strin
• eval can be harmful.
• Unexpected use of `with` statement.
• Empty array binding pattern
• Empty object binding pattern

AI-assisted analysis of oxc-project/oxc@e1e7af627c (2026-08-20). Data as JSON: /api/errors/1415f6072a7278ca. Report an issue: GitHub.