# Disallow the use of unsigned `$A.util.globalEval()` (`@locker/unsafe-types/unsafe-aura-globalEval`)

<!-- end auto-generated rule header -->

A signed eval call means a call to eval with an argument first passed through a signing method.

## Rule Details

Find usages of $A.util.globalEval which are unsigned and report them

The rule imposes a specific way to sign. 
Any deviations, such as using computed member properties instead of the `.` notation, will be reported.
The rule also does not check if the signed value has been assigned to a variable that is later passed as an argument.
Hence, there might be false positives so it is important to check what the code is doing.

There are 2 ways to sign in Aura:

- if this is a component's code use: `A.lockerService.restricted.createScript`
- if this is platform code use: `A.lockerService.trusted.createScript`

Examples of **incorrect** code for this rule:

```js
$A.util.globalEval('foo');
```

Examples of **correct** code for this rule:

```js
$A.util.globalEval($A.lockerService.restricted.createScript('foo'));
```

## When Not To Use It

When eval is not a concern in the codebase.