# Question 86

### Question

What are the security implications of using eval() and new Function()?

### Answer

**Security Implications:**

Both `eval()` and `new Function()` allow you to execute arbitrary code dynamically. This flexibility comes with a significant security risk if you don't handle it carefully:

* **Code Injection:** The most serious danger is the possibility of code injection attacks. If an attacker can control the string passed to `eval()` or `new Function()`, they could inject malicious code into your application. This code could steal sensitive data, modify website content, take control of user accounts, or perform other harmful actions.
* **Unpredictable Behavior:** Evaluating untrusted code can lead to unexpected behavior and vulnerabilities. Code might try to access private variables, modify system settings, or trigger unintended side effects that compromise your application's integrity.

**Illustrative Example (Vulnerability):**

Imagine a website with a feature where users can submit custom JavaScript snippets for display:

```javascript
const userCode = document.getElementById("userInput").value;
eval(userCode); // Extremely dangerous! 
```

If an attacker enters malicious code like `document.cookie = "username=hacker";`, it would be executed, potentially stealing the user's cookie data.

**Mitigating Risks:**

* **Avoid Use Whenever Possible:** The best practice is to avoid `eval()` and `new Function()` altogether. Find alternative, safer ways to achieve your goal.
* **Sanitize Input:** If you absolutely must use them, rigorously sanitize any user-provided input before passing it to these functions. This involves removing potentially harmful characters or code snippets. Libraries like DOMPurify can help with this process.
* **Isolate Execution:** Consider running untrusted code in a sandboxed environment (e.g., using Web Workers) to limit its access to sensitive data and system resources.

**Recommendations:**

* Prioritize writing your code without relying on dynamic code execution. Use built-in JavaScript features and libraries whenever possible.
* If you encounter `eval()` or `new Function()` in existing code, carefully assess the context and consider refactoring it for security.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://choubey.gitbook.io/javascript-interview-questions/question-86.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.