No alert / confirm / prompt

ID

javascript.no_alert

Severity

info

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

low

Resource

Best Practice

Language

JavaScript

Tags

best-practice, browser

Description

Reports calls to the browser’s modal-dialog APIs:

alert("hello");                    // FLAW
confirm("Are you sure?");          // FLAW
const v = prompt("Name?");         // FLAW

Rationale

alert, confirm, and prompt are blocking modal dialogs with a long history of poor UX:

  • they cannot be styled — the look-and-feel comes from the browser, not the application,

  • the user can suppress them per-tab, after which the call returns immediately with the wrong value,

  • mobile browsers sometimes ignore them or render them so small they’re unusable,

  • they freeze the page and pause every other JavaScript timer until the user dismisses them.

In production code these calls almost always represent debugging leftovers or temporary prototypes. The proper alternative is a real UI component (modal, snackbar, toast) or — for non-UI work — a callback / promise.

Remediation

Replace the call with a proper UI affordance:

showModal({
  message: "Are you sure?",
  onConfirm: deleteItem,
  onCancel: noop,
});

If the alert was diagnostic, switch to logging:

console.warn("unexpected state", state);

Notes

The rule matches by the called identifier’s trailing segment, so both bare calls (alert(…​)) and member calls (window.alert(…​)) are flagged. Tests, demos, and bookmarklets that genuinely need these APIs can disable the rule per file or per scan profile.

References