evals

Reports uses of the eval function.

✅ This rule is included in the ts logical and logicalStrict presets.

The eval() function evaluates a string as JavaScript code. This is dangerous because it can execute arbitrary code, potentially leading to security vulnerabilities.

Using eval() has several problems:

Security risks: executing untrusted code can lead to code injection attacks
Performance issues: eval() prevents JavaScript engine optimizations
Debugging difficulty: dynamically executed code is harder to debug and trace
CSP violations: many Content Security Policies prohibit eval()

const 
const code: string
code = 
const getUserInput: () => string
getUserInput();
function eval(x: string): any
Evaluates JavaScript code and executes it.
@param ― x A String value that contains valid JavaScript code.
eval(
const code: string
code);

const 
const result: any
result = 
function eval(x: string): any
Evaluates JavaScript code and executes it.
@param ― x A String value that contains valid JavaScript code.
eval("2 + 2");

const 
const data: "{\"name\": \"John\"}"
data = '{"name": "John"}';
const 
const obj: any
obj = 
var JSON: JSON
An intrinsic object that provides functions to convert JavaScript values to and from the JavaScript Object Notation (JSON) format.
JSON.
JSON.parse(text: string, reviver?: (this: any, key: string, value: any) => any): any
Converts a JavaScript Object Notation (JSON) string into an object.
@param ― text A valid JSON string.
@param ― reviver A function that transforms the results. This function is called for each member of the object.
If a member contains nested objects, the nested objects are transformed before the parent object is.
@throws ― {SyntaxError} If text is not valid JSON.
parse(
const data: "{\"name\": \"John\"}"
data);

const 
const calculate: (a: number, b: number) => number
calculate = (
a: number
a: number, 
b: number
b: number) => 
a: number
a + 
b: number
b;
const 
const result: number
result = 
const calculate: (a: number, b: number) => number
calculate(2, 2);

Options

This rule is not configurable.

When Not To Use It

In rare cases, eval() may be necessary for dynamic code execution, such as in development tools or REPLs. If you have a legitimate use case and understand the security implications, you may disable this rule for specific lines. Consider using the Function constructor as a slightly safer alternative, though it still carries risks.

Equivalents in Other Linters

Biome: noGlobalEval
Deno: no-eval
ESLint: no-eval
Oxlint: eslint/no-eval

Made with ❤️‍🔥 around the world by the Flint team and contributors.

evals

Examples

Options

When Not To Use It

Further Reading

Equivalents in Other Linters