oxc-project/oxc · error · OxcDiagnostic

Using `new Function` or `Function` is not allowed.

Error message

Using `new Function` or `Function` is not allowed.

What it means

Lint diagnostic from eslint/no-new-func: the Function constructor (via new Function(...) or a bare Function(...) call to the global) was detected. It evaluates a string as code at runtime with global scope, which is eval-like, breaks CSP, and defeats tooling/static analysis.

Source

Thrown at crates/oxc_linter/src/rules/eslint/no_new_func.rs:14

use oxc_ast::{
    AstKind,
    ast::{Expression, IdentifierReference, MemberExpression},
};
use oxc_diagnostics::OxcDiagnostic;
use oxc_macros::declare_oxc_lint;
use oxc_semantic::IsGlobalReference;
use oxc_span::Span;
use oxc_str::static_ident;

use crate::{AstNode, context::LintContext, rule::Rule};

fn no_new_func(function_call_span: Span, arguments_span: Option<Span>) -> OxcDiagnostic {
    let mut diagnostic = OxcDiagnostic::warn("Using `new Function` or `Function` is not allowed.")
        .with_help(
            "Avoid the `Function` constructor. Define the function directly with a function declaration/expression or an arrow function.",
        )
        .with_note(
            "The `Function` constructor compiles code from strings at runtime, which can introduce injection risks, hurts performance, and makes code harder to analyze and maintain.",
        )
        .with_label(function_call_span.primary_label("Dynamic function construction is used here."));

    if let Some(arguments_span) = arguments_span {
        diagnostic = diagnostic.and_label(
            arguments_span.label("`Function` evaluates source text at runtime, similar to `eval`."),
        );
    }
    diagnostic
}

#[derive(Debug, Default, Clone)]
pub struct NoNewFunc;

View on GitHub (pinned to e1e7af627c)

Solutions

1. Define the function directly with a function expression or arrow function
2. Build behavior with closures over data instead of strings

When it happens

Trigger: Thrown at crates/oxc_linter/src/rules/eslint/no_new_func.rs:14 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of oxc-project/oxc@e1e7af627c (2026-08-20). Data as JSON: /api/errors/ce5b37535e09d8ee. Report an issue: GitHub.