Avoid document.all

ID

javascript.avoid_document_all

Severity

low

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

low

Resource

Reliability

Language

JavaScript

Tags

best-practice, reliability

Description

Reports access to the legacy document.all collection. document.all exists only for backward compatibility with Internet Explorer 4-era code; modern DOM APIs intentionally omit it.

Rationale

  • The standard says document.all is — a unique JS quirk that makes it typeof "undefined" and == null, designed to fail the legacy if (document.all) IE-detection check on modern browsers. Anyone reading the code expects standard semantics and will be surprised.

  • The collection is intentionally not iterable in the standard for …​ of sense, complicating any modern usage.

  • It’s deprecated and routinely flagged by linters, type checkers, and accessibility audits.

// Bad
if (document.all) {
  return "legacy IE";
}
const elements = document.all;

Remediation

Use one of the modern DOM query APIs.

// Good
const elements = document.querySelectorAll("*");
const main = document.getElementById("main");

References