no-implied-eval
Disallow passing a string of code to setTimeout(), setInterval() or execScript()
When the first argument of setTimeout() or setInterval() is a string, browsers compile and run it like eval() does. The code runs in the global scope, so it can't see your local variables, and anything a user typed that ends up in the string gets executed.
Configure#
Off by default. To turn it on:
bunfig.toml
[lint.rules]
"no-implied-eval" = "error" # or "warn"Examples#
example.js3 problems
setTimeout("refresh()", 1000)Implied eval. Consider passing a function instead of a string.;
setInterval("poll('" + url + "')", 5000)Implied eval. Consider passing a function instead of a string.;
window.setTimeout(`save(${id})`, 0)Implied eval. Consider passing a function instead of a string.;The rule follows a constant that holds a string:
example.js1 problem
const code = "refresh()";
setTimeout(code, 1000)Implied eval. Consider passing a function instead of a string.;example.jsNo problems
setTimeout(refresh, 1000);
setInterval(() => poll(url), 5000);
window.setTimeout(() => save(id), 0);Your own function with the same name isn't reported:
example.jsNo problems
import { setTimeout } from "./fake-timers.js";
setTimeout("tick", 1000);