---
title: JavaScript – Avoid Use Of Function Constructors
description: "Impact Area Security Severity High Affected Element All ## Rule number **SN-0127** ## Impact In addition to being obtuse from a syntax perspective, function constructors are also dangerous: their execution evaluates the constructor string arguments similar to the way eval works, which…"
url: "https://community-staging.qualityclouds.com/qcdocs/qcr/rules/javascript-avoid-use-of-function-constructors/"
updated: "2025-03-21"
category: Data Privacy and GDPR O365
---

# JavaScript – Avoid Use Of Function Constructors

Impact Area

Security

           Severity

High

           Affected Element

All

## Rule number

**SN-0127**

## Impact

In addition to being obtuse from a syntax perspective, function constructors are also dangerous: their execution evaluates the constructor string arguments similar to the way eval works, which could expose your program to random, unintended code which can be both slow and a security risk.

## Remediation

Avoid function constructors altogether.

### Time to fix

30 min

## References

This rule is linked to [Common Weakness Enumeration CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code (Eval Injection)](https://cwe.mitre.org/data/definitions/95.html).

## Code examples

### Noncompliant code

var obj = new Function(“return ” + data)(); // Noncompliant

### Compliant code

var obj = JSON.parse(data);