Calling a Non-Callable Global
ID |
javascript.no_obj_calls |
Severity |
high |
Remediation Complexity |
trivial |
Remediation Risk |
low |
Remediation Effort |
low |
Resource |
Reliability |
Language |
JavaScript |
Tags |
reliability, suspicious-comparison |
Description
Reports calls to global namespace objects that are not callable: Math, JSON, Reflect, Atomics, Intl. These names are namespace objects that hold static methods and constants — calling them as functions throws TypeError: X is not a function at runtime.
Rationale
The most common cause is a typo for the intended static method (e.g. Math() written instead of Math.abs(…)), or a confusion with constructor-callable objects (Date, Array, String). Either way, the call always fails — the error never surfaces in static type-poor JavaScript until production traffic hits the path.
// Bad - throws "Math is not a function"
const r = Math();
const obj = JSON();Remediation
Call the intended static method explicitly.
// Good
const r = Math.abs(value);
const obj = JSON.parse(payload);