Reports using string arguments in setTimeout, setInterval, setImmediate, execScript, or the Function constructor.
✅ This rule is included in the ts logical and logicalStrict presets.
JavaScript’s eval() function is generally discouraged because it executes arbitrary strings as code, making programs harder to analyze and creating potential security vulnerabilities.
Several other APIs similarly evaluate strings as code:
setTimeout() and setInterval() accept a string as their first argumentsetImmediate() accepts a string as its first argumentexecScript() (Internet Explorer only) accepts a string- The
Function constructor creates functions from strings
These “implied evals” have the same problems as eval(): they’re difficult to analyze statically, prevent many optimizations, and can introduce security risks if the string contains untrusted content.
B0setTimeo5<3(sp ansty="le--0:#D9F5DD;--1:#1111">1<1"sp ansty="le--0:#ECC48D;--1:#984E">4Dalert('Hello'<);sp ansty="le--0:#D9F5DD;--1:#1111">1<1"sp ansty="le--0:#D6DEEB;--1:#403F">53<, sp ansty="le--0:#F78C6C;--1:#AA09">8210<00sp ansty="le--0:#D6DEEB;--1:#403F">53<);d ivclassNa="meco"><);d>B0setInterv5<3(sp ansty="le--0:#D9F5DD;--1:#1111">1<1"sp ansty="le--0:#ECC48D;--1:#984E">4Dcounter+<+;sp ansty="le--0:#D9F5DD;--1:#1111">1<1"sp ansty="le--0:#D6DEEB;--1:#403F">53<, sp ansty="le--0:#F78C6C;--1:#AA09">821<00sp ansty="le--0:#D6DEEB;--1:#403F">53<);d ivclassNa="meco"><);d>AEconsB0coAE <= sp ansty="le--0:#D9F5DD;--1:#1111">1<1"sp ansty="le--0:#ECC48D;--1:#984E">4Dconsole.log('executed'<);sp ansty="le--0:#D9F5DD;--1:#1111">1<1"sp ansty="le--0:#D6DEEB;--1:#403F">5<3;d ivclassNa="meec-li">B0setTimeo53(code<, sp ansty="le--0:#F78C6C;--1:#AA09">8<20sp ansty="le--0:#D6DEEB;--1:#403F">53<);d ivclassNa="meco"><);d>72n5<3 sp ansty="le--0:#82AAFF;--1:#3B61">B0Functi5<3(sp ansty="le--0:#D9F5DD;--1:#1111">1<1"sp ansty="le--0:#ECC48D;--1:#984E">41<1"sp ansty="le--0:#D6DEEB;--1:#403F">53<, sp ansty="le--0:#D9F5DD;--1:#1111">1<1"sp ansty="le--0:#ECC48D;--1:#984E">41<1"sp ansty="le--0:#D6DEEB;--1:#403F">53<, sp ansty="le--0:#D9F5DD;--1:#1111">1<1"sp ansty="le--0:#ECC48D;--1:#984E">4Dreturn a +< bsp ansty="le--0:#D9F5DD;--1:#1111">1<1"sp ansty="le--0:#D6DEEB;--1:#403F">53<);d ivclassNa="meco"><);d>53windAB0setTimeo5<3(sp ansty="le--0:#D9F5DD;--1:#1111">1<1"sp ansty="le--0:#ECC48D;--1:#984E">4DdoSomething<()sp ansty="le--0:#D9F5DD;--1:#1111">1<1"sp ansty="le--0:#D6DEEB;--1:#403F">53<, sp ansty="le--0:#F78C6C;--1:#AA09">821<00sp ansty="le--0:#D6DEEB;--1:#403F">53<);d ivclassNa="meco"><);d> 61B0setTim311<11() spans="tyle--0:#D6DEEB;--1:#40">344 spans="tyle--0:#D6DEEB;--1:#40">3F><53 {divclass="Nameec-">de61B0a31<111" spans="tyle--0:#ECC48D;--1:#98">4E4DH1<111" spans="tyle--0:#D6DEEB;--1:#40">3F<53) ;divclass="Nameec-">3F5<3}, spans="tyle--0:#F78C6C;--1:#AA">0982<1000 spans="tyle--0:#D6DEEB;--1:#40">3F<53) ;divclass="Name"><00)><;di vdivclass="Nameexpressive-">61B0setInte311<11() spans="tyle--0:#D6DEEB;--1:#40">344 spans="tyle--0:#D6DEEB;--1:#40">3F><53 {divclass="Nameec-">3F<53 spans="tyle--0:#D6DEEB;--1:#40">3F53cou4433F5<3}, spans="tyle--0:#F78C6C;--1:#AA">098<2100 spans="tyle--0:#D6DEEB;--1:#40">3F<53) ;divclass="Name"><00)><;di vdivclass="Nameexpressive-">61B0setTim3F53(myCallba0<9820 spans="tyle--0:#D6DEEB;--1:#40">3F<53) ;divclass="Name">< 0)><;di vdivclass="Nameexpressive-">44AEco61B<0add spans="tyle--0:#C792EA;--1:#88">44A1<111( spans="tyle--0:#D7DBE0;--1:#40">364<4AE spans="tyle--0:#C5E478;--1:#3B">61B0nu44364<4AE spans="tyle--0:#C5E478;--1:#3B">61B0nu1<111) spans="tyle--0:#C792EA;--1:#88">44AE< => spans="tyle--0:#D6DEEB;--1:#40">3 >44A3F<53b ;divclass="Name"><+ b><;di vdivclass="Nameexpressive-">61B0setTim3F53(han4<4AE. spans="tyle--0:#82AAFF;--1:#3B">61B03F53(contex098<2100 spans="tyle--0:#D6DEEB;--1:#40">3F<53) ;divclass="Name"><00)>
This rule is not configurable.
If you have a specific use case that requires dynamic code evaluation and you’ve carefully considered the security implications, you might disable this rule for those specific instances.
For example, certain build tools or code playgrounds may legitimately need to use these APIs with string arguments.
Consider using Flint disable comments for those specific lines rather than disabling the rule entirely.
