# no-eval

> Disallow `eval()`

`eval()` runs a string as code, with access to the variables around the call. If any part of that string comes from outside your program, the person who controls it can run anything your program can.

Most uses have a direct replacement: `JSON.parse()` for data, `object[key]` for a property chosen by name.

{/* Generated by src/codegen/lint-rule-docs.ts. Do not edit this section. */}

## Configure

Off by default. To turn it on:

```toml bunfig.toml
[lint.rules]
"no-eval" = "error" # or "warn"
```

Every option, set to its default:

```toml bunfig.toml
[lint.rules]
"no-eval" = ["error", {
  allowIndirect = false,
}]
```

{/* End of the generated section. */}

## Examples

Reported:

{/* bad */}
```js
const settings = eval("(" + text + ")");
```

Reaching `eval` another way is reported too:

{/* bad {"count": 3} */}
```js
const run = eval;
globalThis.eval(code);
(0, eval)(code);
```

Not reported:

{/* good */}
```js
const settings = JSON.parse(text);
const value = user[field];
```

A method named `eval` on your own object is fine:

{/* good */}
```js
const result = sandbox.eval(code);
```

## Options

| Option | Default | What it does |
| --- | --- | --- |
| `allowIndirect` | `false` | Allow indirect calls to `eval`. |

An indirect call runs the code in the global scope, so it can't read or change the local variables around the call:

{/* good {"options": [{"allowIndirect": true}]} */}
```js
(0, eval)(code);
globalThis.eval(code);
eval?.(code);
```

A direct call is still reported:

{/* bad {"options": [{"allowIndirect": true}]} */}
```js
eval(code);
```