# Running text as code: `eval`, `exec`, `new Function`

*Shortcuts that trade away safety*: one of the ways AI coding agents bloat software, from lessloc's [pattern catalog](https://lessloc.org/patterns/index.md). lessloc catches it as [`unsafe`](https://lessloc.org/guide/reference.md#tier-1): parse the input instead.

## What makes running text as code (eval, exec, new Function) a bad practice?

The standard that calls it a bad practice: [CWE-95](https://cwe.mitre.org/data/definitions/95.html) Eval Injection.

## What does lessloc do about running text as code (eval, exec, new Function)?

lessloc catches it as [`unsafe`](https://lessloc.org/guide/reference.md#tier-1): parse the input instead.

- `unsafe` (tier 1): A shortcut that trades away safety: SQL built from values, HTML built or escaped by hand, `Math.random()` for secrets, a fast hash for passwords, certificate checks turned off, text run as code.

## Examples

Caught as `unsafe`:

```js [co.js]
export const calc = expr => eval(expr);
```

Written well:

```js [co.js]
export const calc = (a, b) => a + b;
```

## Related patterns

Hand-written versions of what the platform does safely. They are short, which is why agents reach for them. The other patterns in [Shortcuts that trade away safety](https://lessloc.org/patterns/index.md#shortcuts-that-trade-away-safety):

- [SQL built from values instead of query parameters](https://lessloc.org/patterns/sql-from-values.md): lessloc catches it as `unsafe`: pass values as query parameters.
- [HTML built or escaped by hand](https://lessloc.org/patterns/html-by-hand.md): lessloc catches it as `unsafe`: use `textContent` or the framework's rendering.
- [Math.random() or random for tokens and passwords](https://lessloc.org/patterns/weak-randomness.md): lessloc catches it as `unsafe`: `crypto.randomUUID()`, `getRandomValues()` or the `secrets` module.
- [Fast hashes (MD5, SHA-1, SHA-256) for passwords](https://lessloc.org/patterns/password-hash.md): lessloc catches it as `unsafe`: bcrypt, scrypt or argon2.
- [Certificate checks turned off](https://lessloc.org/patterns/tls-off.md): lessloc catches it as `unsafe`.