js/no-eval

Why

A string run as code executes with the page's full rights: if any part of it comes from a URL, storage or a server response, it is cross-site scripting. It also forces a Content Security Policy to allow unsafe-eval and stops the engine from optimising the surrounding code.

Fix

Pass functions, not strings: setTimeout(save, 500). Parse data with JSON.parse, look values up in an object or Map instead of building property names as code, and use a template or the DOM for markup.

Examples

// bad
setTimeout('refresh()', 1000)
const total = eval(`${a} + ${b}`)
// good
setTimeout(refresh, 1000)
const total = a + b

Sources

• MDN, eval() (never use direct eval)
• MDN, Content Security Policy (unsafe-eval)
• ESLint, no-implied-eval

Read it in the terminal

npx github:dawidolko/frontend-skills explain js/no-eval