Avoid `eval` with expressions
ID: typescript-node-security/detect-eval-with-expression
Language: TypeScript
Severity: Warning
Category: Security
Description
The eval
function could execute malicious code if used with non-literal values. The argument provided to the eval
method could be use to execute malicious code, if an attacker manage to control the eval
argument they can execute arbitrary code.
In JavaScript, the eval()
function evaluates or executes an argument if it’s a string of JavaScript code. If this argument is influenced by user input or other external sources, it can lead to security vulnerabilities. Specifically, if an attacker can control or manipulate the value of the variable
in eval(variable)
, they can execute arbitrary code.
It is recommended to avoid eval
at all cost, but if you face an advance use case make sure to use literal values that are under you control or take actions to sanitize the input, even then it is still recommended to avoid the use of eval
as it has lead to security breaches before.
Non-Compliant Code Examples
eval(a);
global.eval(a);
globalThis.eval(a);
const answer = eval(expression)
Compliant Code Examples
eval('alert()')
global.eval('a');
globalThis.eval('a');