Rules / JavaScript / TypeScript
SHIELD-JS-005
Dangerous eval() usage
What it detects
eval() executes arbitrary code and is a common attack vector.
How to fix
Remove eval(). Use JSON.parse() for data or refactor to avoid dynamic code execution.
Vulnerable — Shield flags thisconfig-loader.js
function parseSettings(raw) {
// raw arrives from a postMessage event
return eval("(" + raw + ")");
}
Fixed — scans cleanconfig-loader.js
function parseSettings(raw) {
return JSON.parse(raw);
}
Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-JS-005, the fixed one does not.