Skip to content

Bug: Fail to disable eval() #44516

@caoccao

Description

@caoccao

Version

v16.17.0

Platform

Microsoft Windows NT 10.0.19044.0 x64

Subsystem

No response

What steps will reproduce the bug?

Background

I'm embedding Node.js in a C++ application and want to disable eval() for security concern.

Reproduce

  • Build command: vcbuild.bat static without-intl
  • C++ code: v8Context->AllowCodeGenerationFromStrings(false);

How often does it reproduce? Is there a required condition?

This is a consistent behavior malfunction. It doesn't require any conditions.

What is the expected behavior?

The expected result is calling eval() returns an error EvalError: Code generation from strings disallowed for this context. However, in v16.17.0 the eval() still works. It used to be working well in v16.16.0.

What do you see instead?

The eval() is not disabled.

Additional information

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    v8 engineIssues and PRs related to the V8 dependency.

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions