Function() constructor

Warning: The arguments passed to this constructor are dynamically parsed and executed as JavaScript. APIs like this are known as injection sinks, and are potentially a vector for cross-site-scripting (XSS) attacks. You can mitigate this risk by always passing TrustedScript objects instead of strings and enforcing trusted types. See Security considerations for more information.

The Function() constructor creates Function objects. Calling the constructor directly can create functions dynamically, but suffers from security and similar (but far less significant) performance issues as eval(). However, unlike eval (which may have access to the local scope), the Function constructor creates functions which execute in the global scope only.

Syntax example: new Function(functionBody)