> For the complete documentation index, see [llms.txt](https://choubey.gitbook.io/javascript-interview-questions/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://choubey.gitbook.io/javascript-interview-questions/question-86.md).

# Question 86

### Question

What are the security implications of using eval() and new Function()?

### Answer

**Security Implications:**

Both `eval()` and `new Function()` allow you to execute arbitrary code dynamically. This flexibility comes with a significant security risk if you don't handle it carefully:

* **Code Injection:** The most serious danger is the possibility of code injection attacks. If an attacker can control the string passed to `eval()` or `new Function()`, they could inject malicious code into your application. This code could steal sensitive data, modify website content, take control of user accounts, or perform other harmful actions.
* **Unpredictable Behavior:** Evaluating untrusted code can lead to unexpected behavior and vulnerabilities. Code might try to access private variables, modify system settings, or trigger unintended side effects that compromise your application's integrity.

**Illustrative Example (Vulnerability):**

Imagine a website with a feature where users can submit custom JavaScript snippets for display:

```javascript
const userCode = document.getElementById("userInput").value;
eval(userCode); // Extremely dangerous! 
```

If an attacker enters malicious code like `document.cookie = "username=hacker";`, it would be executed, potentially stealing the user's cookie data.

**Mitigating Risks:**

* **Avoid Use Whenever Possible:** The best practice is to avoid `eval()` and `new Function()` altogether. Find alternative, safer ways to achieve your goal.
* **Sanitize Input:** If you absolutely must use them, rigorously sanitize any user-provided input before passing it to these functions. This involves removing potentially harmful characters or code snippets. Libraries like DOMPurify can help with this process.
* **Isolate Execution:** Consider running untrusted code in a sandboxed environment (e.g., using Web Workers) to limit its access to sensitive data and system resources.

**Recommendations:**

* Prioritize writing your code without relying on dynamic code execution. Use built-in JavaScript features and libraries whenever possible.
* If you encounter `eval()` or `new Function()` in existing code, carefully assess the context and consider refactoring it for security.