> For AI agents: the complete documentation index is available at https://rslint.rs/llms.txt, the full documentation bundle is available at https://rslint.rs/llms-full.txt.

# no-eval

[Added in v0.4.2](https://github.com/web-infra-dev/rslint/releases/tag/v0.4.2)
## Configuration


```ts title=rslint.config.ts
import { defineConfig, js } from '@rslint/core';

export default defineConfig([
  js.configs.recommended,
  {
    rules: {
      'no-eval': 'error',
    },
  },
]);
```

## Rule Details

Disallow the use of `eval()`. JavaScript's `eval()` function is potentially dangerous and is often misused. Using `eval()` on untrusted code can open a program up to several different injection attacks. The use of `eval()` in most contexts can be substituted for a better, alternative approach to a problem.

Examples of **incorrect** code for this rule:

```javascript
eval('var a = 0');

var foo = eval;

this.eval('var a = 0');

window.eval('var a = 0');

global.eval('var a = 0');

globalThis.eval('var a = 0');
```

Examples of **correct** code for this rule:

```javascript
var obj = { eval: function () {} };
obj.eval('var a = 0');

class A {
  eval() {}
}
new A().eval('var a = 0');
```

### Options

This rule has an option to allow indirect calls to `eval`. Indirect calls to `eval` are less dangerous than direct calls because they cannot dynamically change the scope.

```json
{
  "no-eval": ["error", { "allowIndirect": true }]
}
```

With `{ "allowIndirect": true }`, the following patterns are **correct**:

```javascript
(0, eval)('var a = 0');

var EVAL = eval;
EVAL('var a = 0');

window.eval('var a = 0');
```

## Original Documentation

- [ESLint: no-eval](https://eslint.org/docs/latest/rules/no-eval)
- [Source code](https://github.com/eslint/eslint/blob/v10.8.1/lib/rules/no-eval.js)