oxc-project/oxc · warning

Implied eval. Do not use execScript().

Error message

Implied eval. Do not use execScript().

What it means

The execScript variant of oxlint's no-implied-eval rule. execScript() is the legacy Internet Explorer counterpart of eval and always compiles and executes a string as code. The rule reports any call to the global execScript with 'Implied eval. Do not use execScript().' because no safe static use exists.

Solutions

1. Delete the IE shim: execScript does not exist in modern browsers and the call throws.
2. Replace dynamic code strings with direct function calls.
3. If dynamic evaluation is genuinely required, isolate it in a reviewed sandbox module and suppress the line explicitly.

Example fix

// before
execScript('doSetup()');

// after
doSetup();

const execScriptCall = /\bexecScript\s*\(/.test(source);

When it happens

Trigger: execScript('alert(1)');; window.execScript(code) inside IE compatibility shims; copy-paste from old MSDN-era samples.

Common situations: IE-era compatibility layers still living in bundles; enterprise code that once supported IE8; ancient forum answers reused as utilities.

Related errors

• Implied eval. Consider passing a function instead of a…
• eval can be harmful.
• Unexpected use of `with` statement.
• all spread attributes are treated as if they contain an…
• All 'var' declarations must be at the top of the function…

AI-assisted analysis of oxc-project/oxc@e1e7af627c (2026-08-20). Data as JSON: /api/errors/1415f6072a7278ca. Report an issue: GitHub.

Appendix: source

Thrown at crates/oxc_linter/src/rules/eslint/no_implied_eval.rs:20

    AstKind,
    ast::{Argument, CallExpression, Expression, IdentifierReference, MemberExpression},
};
use oxc_diagnostics::OxcDiagnostic;
use oxc_macros::declare_oxc_lint;
use oxc_semantic::IsGlobalReference;
use oxc_span::Span;
use oxc_syntax::operator::{BinaryOperator, UnaryOperator};

use crate::{AstNode, config::GlobalValue, context::LintContext, rule::Rule};

fn implied_eval_diagnostic(span: Span) -> OxcDiagnostic {
    OxcDiagnostic::warn("Implied eval. Consider passing a function instead of a string.")
        .with_help("Pass a function callback instead of source text.")
        .with_label(span)
}

fn exec_script_diagnostic(span: Span) -> OxcDiagnostic {
    OxcDiagnostic::warn("Implied eval. Do not use execScript().")
        .with_help("Avoid executing source text at runtime.")
        .with_label(span)
}

#[derive(Debug, Default, Clone)]
pub struct NoImpliedEval;

declare_oxc_lint!(
    /// ### What it does
    ///
    /// Disallows passing strings to `setTimeout()`, `setInterval()`, and
    /// `execScript()`.
    ///
    /// ### Why is this bad?
    ///
    /// Passing a string to these APIs evaluates the string as JavaScript source
    /// text at runtime. This has many of the same security, readability, and
    /// performance problems as `eval()`. Pass a function instead.

View on GitHub (pinned to e1e7af627c)