Runtime-generated functions
Generate executable behavior from code supplied at runtime in a controlled environment.
JavaScript · Class
Function
The Function() constructor dynamically creates a callable Function object from parameter names and a function-body string. It runs in the global scope rather than capturing the local scope where it was created.
How it works
The Function constructor builds a new function by treating every argument except the last as a parameter name and the final argument as the function body. The resulting function is parsed at construction time and runs with access only to its own scope and global scope, not the local scope where it was created.
Syntax
new Function(functionBody)
new Function(arg1, functionBody)
new Function(arg1, arg2, functionBody)
new Function(arg1, arg2, /* …, */ argN, functionBody)
Function(functionBody)
Function(arg1, functionBody)
Function(arg1, arg2, functionBody)
Function(arg1, arg2, /* …, */ argN, functionBody)Parameters
| Name | Type | Description |
|---|---|---|
arg1 … argN | string | One or more strings naming the function parameters; each argument before the final argument contributes a parameter name. |
functionBody | string | TrustedScript | JavaScript statements forming the function body; it may be a string or TrustedScript. |
Returns
A new Function instance.
Key points
- It creates a new callable Function object from supplied strings.
- Every argument except the final one supplies a parameter name, in order.
- The function body may be supplied as a string or TrustedScript value.
- Calling Function() and using new Function() produce the same kind of instance.
- Constructed functions do not capture the lexical environment where construction occurs.
- At runtime, access is limited to the function's own locals and global bindings.
Common mistakes
- Never pass untrusted strings to the constructor: its inputs are parsed and executed as code, creating an injection and potential XSS risk.
- Prefer a function declaration or expression for static code because dynamically constructed functions incur parsing and performance costs.
- A dynamically created function cannot close over local variables from the scope that constructed it.
Example: Create a function dynamically
const multiply = new Function("a", "b", "return a * b");
console.log(multiply(3, 4)); // 12Creates a function from parameter names and a function-body string, then invokes it.
When to use it
Programmatic function assembly
Build a callable function when parameter names and implementation text are produced programmatically.
Interview questions
QHow does the Function constructor interpret its arguments?
Function() creates a new Function object from strings. Arguments before the final one become parameter names, while the final argument becomes the function body.
Follow-up: What happens if it is called without new? It has the same effect: both forms create a new Function instance.
QHow does its scope differ from eval?
Unlike eval, a function created this way executes only in the global scope. It therefore cannot access local bindings from the constructor's surrounding scope.
Follow-up: Can it access variables declared inside itself? Yes; its own parameters and local declarations remain available during execution.
QWhy is the Function constructor usually discouraged?
The constructor parses the supplied function when the Function object is created. Static declarations and expressions are generally more efficient because they are parsed with the surrounding code.
Follow-up: What is the main security concern? Untrusted input can become executable JavaScript, so dynamic construction should be avoided for such input.
Related
Function.prototypeFunction.prototype.apply()Function.prototype.bind()Function.prototype.call()eval()function expression