Conditional comments¶
ID: js/conditional-comment
Kind: problem
Security severity:
Severity: warning
Precision: very-high
Tags:
- quality
- reliability
- correctness
- portability
- language-features
- external/cwe/cwe-758
Query suites:
- javascript-security-and-quality.qls
Click to see the query in the CodeQL repository
Conditional comments are only supported in Internet Explorer and should be avoided for portability.
Recommendation¶
Use feature detection (as offered by major frameworks such as jQuery) instead.
Example¶
The following code snippet uses conditional comments to detect whether it is running on Internet Explorer 9 or newer. A better alternative would be to directly check for the desired features using, for instance, jQuery’s $.support object.
/*@cc_on
@if (@_jscript_version >= 6)
console.log("You're running a new version of IE.");
@else
console.log("You're running an old version of IE.");
@end
@*/
Note that conditional comments are no longer supported in Internet Explorer 11 Standards mode.
References¶
Internet Explorer Dev Center: @cc_on Statement (JavaScript).
Common Weakness Enumeration: CWE-758.