Legacy Octal Notation

ID

javascript.octal_values

Severity

critical

Remediation Complexity

trivial

Remediation Risk

medium

Remediation Effort

low

Resource

Code Smell

Language

JavaScript

Tags

code-style, reliability

Description

Reports the two legacy octal notations that ECMAScript keeps only for backwards compatibility in sloppy mode:

  • a number literal with a bare leading zero — 0755 is read as base 8, so it holds 493, not the 755 a reader sees;

  • a legacy octal escape inside a string literal — "\101" is the single character A, not the three characters 101.

The modern, unambiguous notations are correct and are never reported: 0o755 for octal numbers, 0x1f for hexadecimal, 0b1010 for binary, and the hexadecimal ("\x41") and Unicode escapes for characters. So is the lone digit 0 and the NUL escape "\0" when no octal digit follows it.

Rationale

// Bad
const mode = 0755;              // 493, not 755
fs.chmodSync(path, 0644);       // 420, not 644
const header = "\101\102";      // "AB", not "\101\102"

  • The value silently differs from what the digits read as, and the mistake survives review because the literal looks like an ordinary decimal number.

  • Both forms are a SyntaxError in strict mode and inside an ES module, so the file stops parsing the moment "use strict" is added or the file is imported as a module — the defect is not merely a readability one.

  • Bundlers and transpilers that emit strict-mode output turn the same code into a build failure rather than a runtime surprise.

Remediation

Write the octal prefix explicitly, or use the decimal value if base 8 was never intended. Replace a legacy string escape with the hexadecimal or Unicode form.

// Good
const mode = 0o755;             // clearly base 8
fs.chmodSync(path, 0o644);
const header = "\x41\x42";      // "AB", stated plainly

References

© 2026 Xygeni. All rights reserved