-
-
Notifications
You must be signed in to change notification settings - Fork 33.3k
Closed
Labels
v8 engineIssues and PRs related to the V8 dependency.Issues and PRs related to the V8 dependency.
Description
Version
v16.17.0
Platform
Microsoft Windows NT 10.0.19044.0 x64
Subsystem
No response
What steps will reproduce the bug?
Background
I'm embedding Node.js in a C++ application and want to disable eval()
for security concern.
Reproduce
- Build command:
vcbuild.bat static without-intl
- C++ code:
v8Context->AllowCodeGenerationFromStrings(false);
How often does it reproduce? Is there a required condition?
This is a consistent behavior malfunction. It doesn't require any conditions.
What is the expected behavior?
The expected result is calling eval()
returns an error EvalError: Code generation from strings disallowed for this context
. However, in v16.17.0
the eval()
still works. It used to be working well in v16.16.0
.
What do you see instead?
The eval()
is not disabled.
Additional information
No response
Metadata
Metadata
Assignees
Labels
v8 engineIssues and PRs related to the V8 dependency.Issues and PRs related to the V8 dependency.