Never Use eval() or new Function() with User Input

// ❌ eval with user input for "dynamic filtering"
function applyFilter(filterExpression: string, data: any[]) {
  return data.filter((item) => eval(filterExpression))
}
 
// ❌ new Function() with user-controlled template
function renderTemplate(template: string, context: Record<string, unknown>) {
  const fn = new Function('ctx', `return \`${template}\``)
  return fn(context)
}
 
// ❌ setTimeout with string argument
function scheduleAction(userCode: string) {
  setTimeout(userCode, 1000)
}
 
// ❌ innerHTML with user content (bypasses React's escaping)
function RawContent({ html }: { html: string }) {
  const ref = useRef<HTMLDivElement>(null)
  useEffect(() => {
    if (ref.current) {
      ref.current.innerHTML = html  // ❌ XSS vector
    }
  }, [html])
  return <div ref={ref} />
}

// ✅ Use a predefined set of filter functions instead of eval
const FILTERS: Record<string, (item: Product) => boolean> = {
  inStock: (item) => item.quantity > 0,
  onSale: (item) => item.discount > 0,
  premium: (item) => item.price > 100,
}
 
function applyFilter(filterName: string, data: Product[]) {
  const filterFn = FILTERS[filterName]
  if (!filterFn) throw new Error(`Unknown filter: ${filterName}`)
  return data.filter(filterFn)
}
 
// ✅ Use template literals with explicit interpolation
function renderTemplate(template: string, context: Record<string, string>) {
  return template.replace(/\{\{(\w+)\}\}/g, (_, key) => {
    return context[key] ?? ''
  })
}
 
// ✅ setTimeout with function reference, not string
function scheduleAction(action: () => void) {
  setTimeout(action, 1000)
}
 
// ✅ Use dangerouslySetInnerHTML with DOMPurify (see sec-dangerouslysetinnerhtml rule)
import DOMPurify from 'dompurify'
 
function RawContent({ html }: { html: string }) {
  const clean = DOMPurify.sanitize(html)
  return <div dangerouslySetInnerHTML={{ __html: clean }} />
}

# Find eval, new Function, and string-based setTimeout/setInterval
grep -rn "eval(\|new Function(\|setTimeout(\s*['\"\`]\|setInterval(\s*['\"\`]" src/ --include="*.ts" --include="*.tsx"
# Find direct innerHTML assignments
grep -rn "\.innerHTML\s*=" src/ --include="*.ts" --include="*.tsx"