---
title: JavaScript – Avoid Use Of Function Constructors – UI Policy scriptFalse
description: "Impact Area Security Severity High Affected Element UI Policy ## Rule number **SN-0335** ## Impact In addition to being obtuse from a syntax perspective, function constructors are also dangerous: their execution evaluates the constructor string arguments similar to the way eval works,…"
url: "https://community-staging.qualityclouds.com/qcdocs/qcr/rules/javascript-avoid-use-of-function-constructors-ui-policy-scriptfalse/"
updated: "2025-03-21"
category: Best Practices Rules / JavaScript Rules
---

# JavaScript – Avoid Use Of Function Constructors – UI Policy scriptFalse

Impact Area

Security

           Severity

High

           Affected Element

UI Policy

## Rule number

**SN-0335**

## Impact

In addition to being obtuse from a syntax perspective, function constructors are also dangerous: their execution evaluates the constructor string arguments similar to the way eval works, which could expose your program to random, unintended code which can be both slow and a security risk.

## Remediation

Avoid function constructors altogether.

### Time to fix

30 min

## References

This rule is linked to [Common Weakness Enumeration CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code (Eval Injection)](https://cwe.mitre.org/data/definitions/95.html).

## Code examples

### Noncompliant code

var obj = new Function(“return ” + data)(); // Noncompliant

### Compliant code

var obj = JSON.parse(data);