no-eval | Bun Docs

eval() runs a string as code, with access to the variables around the call. If any part of that string comes from outside your program, the person who controls it can run anything your program can.

Most uses have a direct replacement: JSON.parse() for data, object[key] for a property chosen by name.

Configure#

Off by default. To turn it on:

bunfig.toml

[lint.rules]
"no-eval" = "error" # or "warn"

Every option, set to its default:

bunfig.toml

[lint.rules]
"no-eval" = ["error", {
  allowIndirect = false,
}]

Examples#

example.js1 problem

const settings = eval("(" + text + ")");

Reaching eval another way is reported too:

example.js3 problems

const run = eval;
globalThis.eval(code);
(0, eval)(code);

example.jsNo problems

const settings = JSON.parse(text);
const value = user[field];

A method named eval on your own object is fine:

example.jsNo problems

const result = sandbox.eval(code);

Options#

Option	Default	What it does
`allowIndirect`	`false`	Allow indirect calls to `eval`.

An indirect call runs the code in the global scope, so it can't read or change the local variables around the call:

example.jswith { "allowIndirect": true }No problems

(0, eval)(code);
globalThis.eval(code);
eval?.(code);

A direct call is still reported:

example.jswith { "allowIndirect": true }1 problem

eval(code);