I would like to run some rules against pages. These rules are essentially functions that check the page for information. They can be simple as in 'check if the page has a title tag' or more complex like 'check if all links on the pages are whitelisted based on example.com/allowed\_links.json'. 
The rules would be run on the page on-demand only and come from a trusted source.

My first approach has been to create a rule service that sends back an javascript array of rules. All the client then has to do is go over the array and run each function in it. The response is a standard object {rule: [name], pass: [true|false], message: [some message about success/failure]}

Since this is on demand only, we fetch the rules from the service and run 'eval' on it. 

**EDIT:** The response from 'mysite/rules' looks like this

```
RULESYSTEM.rules.push(function1() {...});
RULESYSTEM.rules.push(function2() {...});
...

```

```
    const RULESYSTEM = {
      rules: [],
    };
    let rules = fetch('mysite/rules')
    let rulesscript = await rules.text();
    eval(rulescript)
    ...
      //eval will  populate the previously declared rules array.
      let pass = true;
      for(let i=0; i < RULESYSTEM.rules.length; i++) {
        let rule = RULESYSTEM.rules[i];
        //This obj has only one property. Get that one.
        let result = rule();
        pass = pass && result.pass;
      }
    ...

```

This works perfectly fine. However it is receiving a lot of pushback as 'eval' is considered evil and to be avoided at any cost. The security is not an issue here since the source is within the organization itself and thus trusted. 

Are there any other ways to implement a system like this.