Non-Portable Method Call

ID

javascript.non_portable_methods

Severity

info

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

low

Resource

Best Practice

Language

JavaScript

Tags

best-practice, deprecated, portability

Description

Reports a call to a JavaScript API that is deprecated, vendor-prefixed, or otherwise not portable across modern runtimes:

escape("hello world");                          // FLAW — use encodeURIComponent
element.attachEvent("onclick", handler);        // FLAW — IE only, use addEventListener
date.getYear();                                 // FLAW — deprecated, use getFullYear
window.webkitRequestAnimationFrame(cb);         // FLAW — vendor-prefixed, use requestAnimationFrame

Rationale

Each of these APIs has either been removed from a major runtime, behaves differently from its modern replacement, or only exists in one browser family:

  • escape / unescape are removed from the language standard. They handle only Latin-1 input correctly.

  • Date#getYear returns "year minus 1900" — a 90s-era artifact. getFullYear is the modern replacement.

  • attachEvent / detachEvent / fireEvent are Internet Explorer 8-and-below only.

  • webkit* / moz* / ms* / o*-prefixed names are non-standard early-2010s implementations of features that are now standard without the prefix.

Remediation

Use the modern, standard equivalent:

encodeURIComponent("hello world");
element.addEventListener("click", handler);
date.getFullYear();
window.requestAnimationFrame(cb);

Notes

The list of recognised non-portable names is intentionally curated and conservative. New entries should only be added when the runtime support story is clear (deprecated by the standard, vendor-prefixed, or IE-only). The match is by called-method name, so any call site that happens to name a method the same way is flagged — including unrelated user-defined methods. In practice this is rare: the names in the list are not common in user code.

References