Zennoxa Shield
Rules / JavaScript / TypeScript
SHIELD-JS-006

Dangerous Function() constructor

highJavaScript / TypeScriptCWE-95CVSS 8.1

What it detects

new Function() dynamically compiles code and is equivalent to eval().

How to fix

Avoid the Function constructor. Refactor to static functions.

Vulnerable — Shield flags thistemplate.js
// Render a user-supplied template string
function renderTemplate(tpl, data) {
  const compiled = new Function("data", "return `" + tpl + "`;");
  return compiled(data);
}

module.exports = { renderTemplate };
Fixed — scans cleantemplate.js
// Static, predefined templates only — no dynamic code compilation
const templates = {
  greeting: (data) => `Hello, ${data.name}!`,
  farewell: (data) => `Goodbye, ${data.name}.`,
};

function renderTemplate(name, data) {
  const template = templates[name];
  if (!template) throw new Error("Unknown template: " + name);
  return template(data);
}

module.exports = { renderTemplate };

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-JS-006, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-JS-006: Dangerous Function() constructor — Zennoxa Shield