---
title: JavaScript – Avoid Use Of Function Constructors – Catalog UI Policy scriptFalse
description: "Impact Area Security Severity High Affected Element Catalog UI Policy ## Rule number **SN-0359** ## Impact In addition to being obtuse from a syntax perspective, function constructors are also dangerous: their execution evaluates the constructor string arguments similar to the…"
url: "https://community-staging.qualityclouds.com/qcdocs/qc/javascript-rules-rules-for-servicenow/javascript-avoid-use-of-function-constructors-catalog-ui-policy-scriptfalse/"
updated: "2025-03-21"
category: Rules for ServiceNow / JavaScript Rules
---

# JavaScript – Avoid Use Of Function Constructors – Catalog UI Policy scriptFalse

Impact Area

Security

           Severity

High

           Affected Element

Catalog UI Policy

## Rule number

**SN-0359**

## Impact

In addition to being obtuse from a syntax perspective, function constructors are also dangerous: their execution evaluates the constructor string arguments similar to the way eval works, which could expose your program to random, unintended code which can be both slow and a security risk.

## Remediation

Avoid function constructors altogether.

### Time to fix

30 min

## References

This rule is linked to [Common Weakness Enumeration CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code (Eval Injection)](https://cwe.mitre.org/data/definitions/95.html).

## Code examples

### Noncompliant code

var obj = new Function(“return ” + data)(); // Noncompliant

### Compliant code

var obj = JSON.parse(data);