Security Properties of tsc

Overview

The TypeScript compiler (tsc) is a build tool, not a sandbox. It transforms TypeScript source files into JavaScript output files and reports potential errors. This document describes what tsc guarantees and does not guarantee when invoked on untrusted input.

Security Guarantees

No arbitrary code execution

Running tsc on a malicious .ts or tsconfig.json file will never cause the input code to be executed. The compiler parses, type-checks, and emits; it does not evaluate the programs it compiles. There is no eval-at-compile-time, no macro system, and no plugin mechanism that runs author-supplied code during compilation. This is the core security property of tsc.

Exception: If content mappers are enabled, this does enable execution of third-party code. Only pass the --runExternalCode flag if you have validated which content mappers are available and that you are OK with running them.