Take the 2-minute tour ×

Given this JavaScript code (which is just a comment referring to a url):

// see http://enterprisejquery.com/2010/10/how-good-c-habits-can-encourage-bad-javascript-habits-part-1/

JSLint with "Safe Subset" turned on will say

Dangerous comment.

How can a comment be dangerous? Comments, by definition, aren't parsed! Or are they?

Edit: Using a different url isn't necessarily dangerous. For example this:

// http://enterprisejquery.com

doesn't trigger the flag. How can one URL in a comment be 'dangerous', but another isn't?

share|improve this question

2 Answers 2

up vote 3 down vote accepted

"Dangerous" comments match the regular expression:


In this case, your comment is "dangerous" because it contains the string "script".

I think this is probably a false positive.

share|improve this answer
You're right-- this is script block paranoia. Wow, I wish jslint would just say that. –  paleozogt Jun 14 '12 at 17:38
btw, just doing // script triggers it. Or in the question example, replacing 'javascript' with 'foo' makes the error go away. –  paleozogt Jun 14 '12 at 17:39

You can execute comments manually using eval:



Also, someone might accidently uncomment the dangerous code and create a vulnerability.

By default, no, JavaScript comments are not parsed. But there are not a nice thing to have lying around.

share|improve this answer
JSLint doesn't think that all URLs-in-comments are dangerous, tho. I've edited my question to show this. Why are some URLs dangerous but others aren't? –  paleozogt Jun 14 '12 at 17:21
Also, since the comment isn't actually javascript, how can it be dangerous? Wouldn't the eval just fail? –  paleozogt Jun 14 '12 at 17:29
Good question. I guess Samuel answered that question. But his answer just raises another question of why that regex is actually considered dangerous. –  Stanislav Palatnik Jun 14 '12 at 17:49
It's worried about triggering an end-script block. But I think the regex is capturing too much, as it even matches against 'script', which is obviously not dangerous. –  paleozogt Jun 15 '12 at 15:35

Your Answer


