no-new-func

Function compiles a string into code at runtime, like eval. If any part of the string comes from a user, they can run whatever they like. The code in the string is also invisible to the linter, the type checker and the bundler, and a Content Security Policy without unsafe-eval blocks it.

The rule reports new Function(..), Function(..), Function.call(..), Function.apply(..) and Function.bind(..).

Configure#

Off by default. To turn it on:

[lint.rules]
"no-new-func" = "error" # or "warn"

Examples#

const add = new Function("a", "b", "return a + b");

const run = Function.apply(null, ["input", userCode]);

const add = (a, b) => a + b;

if (callback instanceof Function) {
  callback();
}