Disallow eval() (no-eval)

JavaScript’s eval() function is potentially dangerous and is often misused. Using eval() on untrusted code can open a program up to several different injection attacks. The use of eval() in most contexts can be substituted for a better, alternative approach to a problem.

var obj = { x: "foo" },
    key = "x",
    value = eval("obj." + key);

Rule Details

This rule is aimed at preventing potentially dangerous, unnecessary, and slow code by disallowing the use of the eval() function. As such, it will warn whenever the eval() function is used.

The following patterns are considered warnings:

var obj = { x: "foo" },
    key = "x",
    value = eval("obj." + key);

The following patterns are not considered warnings:

var obj = { x: "foo" },
    key = "x",
    value = obj[key];

Further Reading

Version

This rule was introduced in ESLint 0.0.2.

Resources