Repository navigation
Bug: Fail to disable eval() #44516
Description
Activity
ModifyCodeGenerationFromStringsCallbackis invoked whenAllowCodeGenerationFromStringsis false. Node.js has set itsModifyCodeGenerationFromStringsCallbackto check an internal allow code generation from strings flag.In order to propagate the
AllowCodeGenerationFromStringsto Node.js internal flag slot,context->AllowCodeGenerationFromStringsshould be set beforenode::InitializeContext, or start node with--disallow-code-generation-from-strings(#44324).Alternatively, the embedder can set its own callback of
ModifyCodeGenerationFromStringsCallback.Thank you for the detailed explanation.
In my use case, the application may allow-disallow-allow-disallow... the code generation from strings in one context. It seems setting
ModifyCodeGenerationFromStringsCallbackis the only option. The question now is: will that break anything?Update
I added the following line and it works.
// After V8 isolate is initialized. v8Isolate->SetModifyCodeGenerationFromStringsCallback(nullptr);
VM里 通过 配置实现了 开启和禁用 这样操作 就把vm 的EVAL 彻底禁掉了 VM里是通过代码关闭的
Version
v16.17.0
Platform
Microsoft Windows NT 10.0.19044.0 x64
Subsystem
No response
What steps will reproduce the bug?
Background
I'm embedding Node.js in a C++ application and want to disable
eval()for security concern.Reproduce
vcbuild.bat static without-intlv8Context->AllowCodeGenerationFromStrings(false);How often does it reproduce? Is there a required condition?
This is a consistent behavior malfunction. It doesn't require any conditions.
What is the expected behavior?
The expected result is calling
eval()returns an errorEvalError: Code generation from strings disallowed for this context. However, inv16.17.0theeval()still works. It used to be working well inv16.16.0.What do you see instead?
The
eval()is not disabled.Additional information
No response