TC-008 - I2 String-to-code evaluation
setTimeout with callback function
Context profile
Single run. Browser context is not decisive for this test case, so no context profile is applied.
Content Security Policy
No Content-Security-Policy header is sent.
Cookies
No cookies are set by this page.
Test case
The script passes a real function to setTimeout, not a string. The
callback form is an ordinary timer: it does not evaluate a string as code, so it must not be
reported as I2. This is the negative counterpart of TC-007.
Script output
What to observe
- After 500 ms the output shows
Callback ran after 500 ms.- the timer works normally. - The first argument is an arrow function, not a string, so no string is ever evaluated as code.
No I2 finding is expected. Only the string form of a timer (TC-007) is string-to-code
evaluation; the callback form is a normal construct. This case makes over-reporting visible if
a rule flags every setTimeout regardless of its argument.
Expected outcome
- Purpose
- Check that normal callback-based timers are not reported as string-to-code evaluation.
- Expected finding
- No I2 finding.
- Expected interpretation
- No string-to-code indicator; normal timer construct.
- Expected priority
- None (single run)
- Notes
- Important negative case to limit over-reporting for I2.