Insecure JavaScript operations
Why is this an issue?
The eval() function executes a string as code at runtime. If that string contains user-controlled or untrusted input, an attacker could execute arbitrary code in the application's context.
Examples
Example of incorrect code:
// Aura component
evalCode: function(component, event, helper) {
var userInput = component.get("v.userInput");
eval(userInput);
}
Example of correct code:
// Use safe alternatives
handleAction() {
const config = JSON.parse(this.configString); // Parse JSON safely
this.processConfig(config);
}
How can I fix violations?
Parse the data into an object before use, e.g., with
JSON.parse()for JSON.Refactor logic to remove the need for dynamic code execution.
Resources