security/no-eval

Why

Any of these turns a string into running code. If any part of the string can come from a URL, storage, a message or an API, an attacker can run script in the page. They also force a Content Security Policy to allow 'unsafe-eval', which weakens it for everything else.

Fix

Parse data with JSON.parse, look functions up in an object (handlers[name]()), and pass functions to timers (setTimeout(() => refresh(), 1000)). Keep 'unsafe-eval' out of the CSP.

Examples

// bad
const settings = eval('(' + raw + ')')
setTimeout('refresh()', 1000)
// good
const settings = JSON.parse(raw)
setTimeout(refresh, 1000)

Sources

• MDN, eval() (never use eval)
• MDN, Content-Security-Policy script-src ('unsafe-eval')

Read it in the terminal

npx github:dawidolko/frontend-skills explain security/no-eval