JavaScript · Senior · Question 34 of 75
Why are eval and new Function usually banned by security policy?
- ✓Correct answer: They execute strings as code - a path to XSS
- 2They work only in strict mode and break old browsers
- 3They were removed in ECMAScript 2020 and aren't supported
Explanation
If user data ends up in the string, an attacker runs their own code. CSP blocks such calls by default. Also, eval hinders engine optimizations. There's almost always an alternative: JSON.parse, a function table, Function with code known at build time.