eval(code);

Close

Disallow eval() (no-eval)

JavaScript's eval() function is potentially dangerous and is often misused. Using eval() on untrusted code can open a program up to several different injection attacks. The use of eval() in most contexts can be substituted for a better, alternative approach to a problem.

var obj = { x: "foo" },
    key = "x",
    value = eval("obj." + key);

Rule Details

This rule is aimed at preventing potentially dangerous, unnecessary, and slow code by disallowing the use of the eval() function. As such, it will warn whenever the eval() function is used.

Examples of incorrect code for this rule:

/*eslint no-eval: "error"*/

var obj = { x: "foo" },
    key = "x",
    value = eval("obj." + key);

(0, eval)("var a = 0");

var foo = eval;
foo("var a = 0");

// This `this` is the global object.
this.eval("var a = 0");

Example of additional incorrect code for this rule when browser environment is set to true:

/*eslint no-eval: "error"*/
/*eslint-env browser*/

window.eval("var a = 0");

Example of additional incorrect code for this rule when node environment is set to true:

/*eslint no-eval: "error"*/
/*eslint-env node*/

global.eval("var a = 0");

Examples of correct code for this rule:

/*eslint no-eval: "error"*/
/*eslint-env es6*/

var obj = { x: "foo" },
    key = "x",
    value = obj[key];

class A {
    foo() {
        // This is a user-defined method.
        this.eval("var a = 0");
    }

    eval() {
    }
}

Options

This rule has an option to allow indirect calls to eval. Indirect calls to eval are less dangerous than direct calls to eval because they cannot dynamically change the scope. Because of this, they also will not negatively impact performance to the degree of direct eval.

{
    "no-eval": ["error", {"allowIndirect": true}] // default is false
}

Example of incorrect code for this rule with the {"allowIndirect": true} option:

/*eslint no-eval: "error"*/

var obj = { x: "foo" },
    key = "x",
    value = eval("obj." + key);

Examples of correct code for this rule with the {"allowIndirect": true} option:

/*eslint no-eval: "error"*/

(0, eval)("var a = 0");

var foo = eval;
foo("var a = 0");

this.eval("var a = 0");

/*eslint no-eval: "error"*/
/*eslint-env browser*/

window.eval("var a = 0");

/*eslint no-eval: "error"*/
/*eslint-env node*/

global.eval("var a = 0");

Known Limitations

• This rule is warning every eval() even if the eval is not global's. This behavior is in order to detect calls of direct eval. Such as:

module.exports = function(eval) {
      // If the value of this `eval` is built-in `eval` function, this is a
      // call of direct `eval`.
      eval("var a = 0");
  };

• This rule cannot catch renaming the global object. Such as:

var foo = window;
  foo.eval("var a = 0");

Further Reading

• Eval is Evil, Part One
• How evil is eval

Related Rules

• [no-implied-eval](no-implied-eval.md) Source: http://eslint.org/docs/rules/

    run: function() {
        var code = this.$.input.value;
        var out = '';
        /* helper functions */
        function show(x) {

Close

Cognitive Complexity

Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.

A method's cognitive complexity is based on a few simple rules:

• Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
• Code is considered more complex for each "break in the linear flow of the code"
• Code is considered more complex when "flow breaking structures are nested"

Further reading

• Cognitive Complexity docs
• Cognitive Complexity: A new way of measuring understandability

            if (typeof x == 'object') {

Close

Require === and !== (eqeqeq)

It is considered good practice to use the type-safe equality operators === and !== instead of their regular counterparts == and !=.

The reason for this is that == and != do type coercion which follows the rather obscure Abstract Equality Comparison Algorithm. For instance, the following statements are all considered true:

• [] == false
• [] == ![]
• 3 == "03"

If one of those occurs in an innocent-looking statement such as a == b the actual problem is very difficult to spot.

Rule Details

This rule is aimed at eliminating the type-unsafe equality operators.

Examples of incorrect code for this rule:

/*eslint eqeqeq: "error"*/

if (x == 42) { }

if ("" == text) { }

if (obj.getStuff() != undefined) { }

The --fix option on the command line automatically fixes some problems reported by this rule. A problem is only fixed if one of the operands is a typeof expression, or if both operands are literals with the same type.

Options

always

The "always" option (default) enforces the use of === and !== in every situation (except when you opt-in to more specific handling of null [see below]).

Examples of incorrect code for the "always" option:

/*eslint eqeqeq: ["error", "always"]*/

a == b
foo == true
bananas != 1
value == undefined
typeof foo == 'undefined'
'hello' != 'world'
0 == 0
true == true
foo == null

Examples of correct code for the "always" option:

/*eslint eqeqeq: ["error", "always"]*/

a === b
foo === true
bananas !== 1
value === undefined
typeof foo === 'undefined'
'hello' !== 'world'
0 === 0
true === true
foo === null

This rule optionally takes a second argument, which should be an object with the following supported properties:

• "null": Customize how this rule treats null literals. Possible values:
  • always (default) - Always use === or !==.
  • never - Never use === or !== with null.
  • ignore - Do not apply this rule to null.

smart

The "smart" option enforces the use of === and !== except for these cases:

• Comparing two literal values
• Evaluating the value of typeof
• Comparing against null

Examples of incorrect code for the "smart" option:

/*eslint eqeqeq: ["error", "smart"]*/

// comparing two variables requires ===
a == b

// only one side is a literal
foo == true
bananas != 1

// comparing to undefined requires ===
value == undefined

Examples of correct code for the "smart" option:

/*eslint eqeqeq: ["error", "smart"]*/

typeof foo == 'undefined'
'hello' != 'world'
0 == 0
true == true
foo == null

allow-null

Deprecated: Instead of using this option use "always" and pass a "null" option property with value "ignore". This will tell eslint to always enforce strict equality except when comparing with the null literal.

["error", "always", {"null": "ignore"}]

When Not To Use It

If you don't want to enforce a style for using equality operators, then it's safe to disable this rule. Source: http://eslint.org/docs/rules/

        with (this.$.input) { setContent(value = ''); render(); };

Close

disallow unnecessary semicolons (no-extra-semi)

Typing mistakes and misunderstandings about where semicolons are required can lead to semicolons that are unnecessary. While not technically an error, extra semicolons can cause confusion when reading code.

Rule Details

This rule disallows unnecessary semicolons.

Examples of incorrect code for this rule:

/*eslint no-extra-semi: "error"*/

var x = 5;;

function foo() {
    // code
};

Examples of correct code for this rule:

/*eslint no-extra-semi: "error"*/

var x = 5;

var foo = function() {
    // code
};

When Not To Use It

If you intentionally use extra semicolons then you can disable this rule.

Related Rules

• [semi](semi.md)
• [semi-spacing](semi-spacing.md) Source: http://eslint.org/docs/rules/

            alert(e);

Close

Disallow Use of Alert (no-alert)

JavaScript's alert, confirm, and prompt functions are widely considered to be obtrusive as UI elements and should be replaced by a more appropriate custom UI implementation. Furthermore, alert is often used while debugging code, which should be removed before deployment to production.

alert("here!");

Rule Details

This rule is aimed at catching debugging code that should be removed and popup UI elements that should be replaced with less obtrusive, custom UIs. As such, it will warn when it encounters alert, prompt, and confirm function calls which are not shadowed.

Examples of incorrect code for this rule:

/*eslint no-alert: "error"*/

alert("here!");

confirm("Are you sure?");

prompt("What's your name?", "John Doe");

Examples of correct code for this rule:

/*eslint no-alert: "error"*/

customAlert("Something happened!");

customConfirm("Are you sure?");

customPrompt("Who are you?");

function foo() {
    var alert = myCustomLib.customAlert;
    alert();
}

Related Rules

• [no-console](no-console.md)
• [no-debugger](no-debugger.md) Source: http://eslint.org/docs/rules/

                for (var y in x) {

Close

Require Guarding for-in (guard-for-in)

Looping over objects with a for in loop will include properties that are inherited through the prototype chain. This behavior can lead to unexpected items in your for loop.

for (key in foo) {
    doSomething(key);
}

Note that simply checking foo.hasOwnProperty(key) is likely to cause an error in some cases; see [no-prototype-builtins](no-prototype-builtins.md).

Rule Details

This rule is aimed at preventing unexpected behavior that could arise from using a for in loop without filtering the results in the loop. As such, it will warn when for in loops do not filter their results with an if statement.

Examples of incorrect code for this rule:

/*eslint guard-for-in: "error"*/

for (key in foo) {
    doSomething(key);
}

Examples of correct code for this rule:

/*eslint guard-for-in: "error"*/

for (key in foo) {
    if (Object.prototype.hasOwnProperty.call(foo, key)) {
        doSomething(key);
    }
    if ({}.hasOwnProperty.call(foo, key)) {
        doSomething(key);
    }
}

Related Rules

• [no-prototype-builtins](no-prototype-builtins.md)

Further Reading

• Exploring JavaScript for-in loops
• The pitfalls of using objects as maps in JavaScript Source: http://eslint.org/docs/rules/

        with (this.$.input) { setContent(value = ''); render(); };

Close

disallow with statements (no-with)

The with statement is potentially problematic because it adds members of an object to the current scope, making it impossible to tell what a variable inside the block actually refers to.

Rule Details

This rule disallows with statements.

If ESLint parses code in strict mode, the parser (instead of this rule) reports the error.

Examples of incorrect code for this rule:

/*eslint no-with: "error"*/

with (point) {
    r = Math.sqrt(x * x + y * y); // is r a member of point?
}

Examples of correct code for this rule:

/*eslint no-with: "error"*/
/*eslint-env es6*/

const r = ({x, y}) => Math.sqrt(x * x + y * y);

When Not To Use It

If you intentionally use with statements then you can disable this rule.

Further Reading

• with Statement Considered Harmful Source: http://eslint.org/docs/rules/

        with (this.$.input) {

Close

disallow with statements (no-with)

The with statement is potentially problematic because it adds members of an object to the current scope, making it impossible to tell what a variable inside the block actually refers to.

Rule Details

This rule disallows with statements.

If ESLint parses code in strict mode, the parser (instead of this rule) reports the error.

Examples of incorrect code for this rule:

/*eslint no-with: "error"*/

with (point) {
    r = Math.sqrt(x * x + y * y); // is r a member of point?
}

Examples of correct code for this rule:

/*eslint no-with: "error"*/
/*eslint-env es6*/

const r = ({x, y}) => Math.sqrt(x * x + y * y);

When Not To Use It

If you intentionally use with statements then you can disable this rule.

Further Reading

• with Statement Considered Harmful Source: http://eslint.org/docs/rules/