Running text as code: eval, exec, new Function

Shortcuts that trade away safety: one of the ways AI coding agents bloat software, from lessloc's pattern catalog. lessloc catches it as unsafe: parse the input instead.

What makes running text as code (eval, exec, new Function) a bad practice?

The standard that calls it a bad practice: CWE-95 Eval Injection.

What does lessloc do about running text as code (eval, exec, new Function)?

lessloc catches it as unsafe: parse the input instead.

• unsafe (tier 1): A shortcut that trades away safety: SQL built from values, HTML built or escaped by hand, Math.random() for secrets, a fast hash for passwords, certificate checks turned off, text run as code.

Examples

Caught as unsafe:

export const calc = expr => eval(expr);

Written well:

export const calc = (a, b) => a + b;

Related patterns

Hand-written versions of what the platform does safely. They are short, which is why agents reach for them. The other patterns in Shortcuts that trade away safety:

• SQL built from values instead of query parameters: lessloc catches it as unsafe: pass values as query parameters.
• HTML built or escaped by hand: lessloc catches it as unsafe: use textContent or the framework's rendering.
• Math.random() or random for tokens and passwords: lessloc catches it as unsafe: crypto.randomUUID(), getRandomValues() or the secrets module.
• Fast hashes (MD5, SHA-1, SHA-256) for passwords: lessloc catches it as unsafe: bcrypt, scrypt or argon2.
• Certificate checks turned off: lessloc catches it as unsafe.