detect-eval-with-expression

🔒 CWE-95 OWASP:A05 CVSS:9.8 | Eval Injection detected | CRITICAL [SOC2,PCI-DSS,ISO27001]
   Fix: Review and apply the recommended fix | https://owasp.org/Top10/A05_2021/

// Dynamic eval - CRITICAL risk
const result = eval(userInput);

// Function constructor - HIGH risk
const func = new Function('param', userCode);

// Template evaluation - HIGH risk
const output = eval(`Hello ${userName}!`);

// Object property access - MEDIUM risk
const value = eval(`obj.${property}`);

// Math operations - MEDIUM risk
const calc = eval(`${num1} ${operator} ${num2}`);

// JSON parsing
const data = JSON.parse(userInput);

// Template literals (safe)
const greeting = `Hello ${userName}!`;

// Whitelisted object access
const ALLOWED_PROPS = ['name', 'age', 'email'];
if (ALLOWED_PROPS.includes(property)) {
  const value = obj[property];
}

// Math with validation
const result = calculate(num1, operator, num2);

// Map for dynamic storage
const config = new Map();
config.set(userKey, value);

❌ eval('{"key": "' + value + '"}')
✅ JSON.parse('{"key": "' + value + '"}')

❌ eval('obj.' + property)
✅ const ALLOWED = ['name', 'age']; if (ALLOWED.includes(property)) obj[property]

❌ eval('Hello ' + name + '!')
✅ `Hello ${name}!`

❌ eval(num1 + ' + ' + num2)
✅ const mathOps = { '+': (a, b) => a + b }; mathOps[op](num1, num2)

// Enable rule with warnings first
{
  rules: {
    'node-security/detect-eval-with-expression': 'warn'
  }
}

// Replace common patterns
eval(`obj.${prop}`) → obj[prop] with validation
eval(jsonString) → JSON.parse(jsonString)
eval(mathExpr) → Safe math functions

// Strict enforcement
{
  rules: {
    'node-security/detect-eval-with-expression': 'error'
  }
}

// ❌ NOT DETECTED - Aliased function
const execute = eval;
execute(userInput);

// ❌ NOT DETECTED - Dynamic call
window['eval'](userInput);

// ❌ NOT DETECTED - Wrapper
myEval(userInput); // Uses eval internally