JavaScript Syntax Pattern Checker

The patterns checked in this release

The AST walk looks for direct eval and Function calls, string or template-literal timers, assignments to innerHTML, outerHTML or srcdoc, HTML-writing method calls and exec or execSync-shaped calls. Static bracket properties such as element["innerHTML"] are recognised. Ordinary comments and quoted examples are not treated as executable syntax.

Names do not establish a binding

A local function can be named eval, and an unrelated API can have an exec method. Such code can still match. Conversely, indirect calls, renamed imports and computed property names can escape these checks. This release does not resolve scopes, follow variables or decide whether a string contains untrusted data.

Parsing and output limits

Acorn first tries module syntax, then ordinary script syntax. The reviewer accepts up to 100,000 characters and bounds the AST walk to 20,000 nodes and 256 nesting levels. It counts all matches but lists at most 300 locations. Unsupported syntax and excessive structures produce an error rather than a partial safety claim.

Read the surrounding code

Locations are one-based lines and columns. Results contain counts and generic observations, not the source literals. No code is executed, dependencies are not inspected and runtime behaviour is not observed. A file with zero listed matches may still contain vulnerabilities. Use normal review, tests and context-aware analysis for the application.

References

• Acorn parser interface and options
• JavaScript eval behaviour, MDN

Documentation reviewed: 1 November 2026. Rule results describe the supplied text, not a live application test.

Useful next steps

• GraphQL Query Reviewer
• Secret Redactor
• Practical guides and coding projects

Maintained by MetaCyberGuru. A review point may need source, runtime or deployment context before you act on it.