Avoid `eval` with expressions

이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.

Metadata

ID: javascript-node-security/detect-eval-with-expression

Language: JavaScript

Severity: Warning

Category: Security

Description

The eval function could execute malicious code if used with non-literal values. The argument provided to the eval method could be used to execute malicious code. If an attacker manages to control the eval argument they can execute arbitrary code.

In JavaScript, the eval() function evaluates or executes an argument if it’s a string of JavaScript code. If this argument is influenced by user input or other external sources, it can lead to security vulnerabilities. Specifically, if an attacker can control or manipulate the value of the variable in eval(variable), they can execute arbitrary code.

You should avoid using eval at all costs, but if you face an advanced use case, use literal values that are under your control or sanitize the input. However, even then it is still recommended to avoid the use of eval as it has led to security breaches before.

Non-Compliant Code Examples

eval(a);
global.eval(a);
globalThis.eval(a);

const answer = eval(expression)

Compliant Code Examples

eval('alert()')
global.eval('a');
globalThis.eval('a');
https://static.datadoghq.com/static/images/logos/github_avatar.svg https://static.datadoghq.com/static/images/logos/vscode_avatar.svg jetbrains

Seamless integrations. Try Datadog Code Analysis