---
title: "no-new-func"
description: "Disallow creating functions from strings with `Function`"
# Generated by src/codegen/lint-rule-docs.ts. Do not edit below this line.
plugin: "eslint"
aliases: ["eslint/no-new-func"]
kind: "suggestion"
category: "style"
default: "off"
fixable: "no"
typeAware: false
deprecated: false
---

`Function` compiles a string into code at runtime, like `eval`. If any part of the string comes from a user, they can run whatever they like. The code in the string is also invisible to the linter, the type checker and the bundler, and a Content Security Policy without `unsafe-eval` blocks it.

The rule reports `new Function(..)`, `Function(..)`, `Function.call(..)`, `Function.apply(..)` and `Function.bind(..)`.

{/* Generated by src/codegen/lint-rule-docs.ts. Do not edit this section. */}

## Configure

Off by default. To turn it on:

```toml bunfig.toml
[lint.rules]
"no-new-func" = "error" # or "warn"
```

{/* End of the generated section. */}

## Examples

Reported:

{/* bad */}
```js
const add = new Function("a", "b", "return a + b");
```

{/* bad */}
```js
const run = Function.apply(null, ["input", userCode]);
```

Not reported:

{/* good */}
```js
const add = (a, b) => a + b;

if (callback instanceof Function) {
  callback();
}
```