JavaScript's eval() function is potentially dangerous and is often misused. Using eval() on untrusted code can open a program up to several different injection attacks. The use of eval() in most contexts can be substituted for a better, alternative approach to the problem.

Bad Practice

const obj = { x: "foo" }
const key = "x"
const value = eval("obj." + key);

(0, eval)("var a = 0");

const foo = eval;
foo("var a = 0");

// This `this` is the global object.
this.eval("var a = 0");

Recommended

const obj = { x: "foo" },
    key = "x",
    value = obj[key];

class A {
    foo() {
        // This is a user-defined method.
        this.eval("var a = 0");
    }

    eval() { /* ... * / }
}

References

OWASP A03:2021 - Injection
OWASP Direct Dynamic Code Evaluation - Eval Injection

willtheorangeguy / Note-Style-Guide

No ignore rules found