Global use strict Directive In A Script
ID |
javascript.global_use_strict |
Severity |
low |
Remediation Complexity |
trivial |
Remediation Risk |
low |
Remediation Effort |
medium |
Resource |
Best Practice |
Language |
JavaScript |
Tags |
best-practice, modules, scope |
Description
Reports a "use strict" directive at the top level of a script that is not a module. At that position the directive applies to the whole file, and a file has no say in what it is concatenated with.
A file containing any top-level import or export is already a module and is therefore strict whether the directive is written or not, so nothing is reported there: the directive is redundant, not harmful. The objection is to the global scope, never to strict mode itself.
Only a directive in the prologue counts, the leading run of string-literal statements. A string statement appearing after real code is an unused expression rather than a directive, and is `javascript.no_unused_expressions’s to report.
Rationale
// Bad -- vendor/legacy.js
"use strict";
var legacy = window.jQuery;-
A concatenating bundler joins scripts into one file, and a leading directive then governs every script that follows it.
-
Third-party code written for sloppy mode — an octal literal, an undeclared assignment,
arguments.callee, awithblock — starts throwing at run time, in a file whose author never asked for strict mode. -
The failure appears far from this line and only in the bundle, so it is attributed to the wrong file and usually to the wrong change.
Remediation
Put the directive in each function that wants it, which is the scope the author is actually reasoning about, or make the file a module.
// Good -- the directive is scoped to the function
function boot() {
"use strict";
start(window.jQuery);
}// Also good -- a module is strict already
import { start } from "./boot";
export function boot() {
start();
}