Open
Description
Doc: https://nodejs.org/docs/latest/api/cli.html#--disallow-code-generation-from-strings
It is advertised to cover built-in language features, but it doesn't cover data imports
No Node.js modules are directly imported here
// run with node and node --disallow-code-generation-from-strings
const payload = 'console.log("evaluated code from string")'
try { eval(payload) } catch (e) { console.log(e.message) }
try { new Function(payload)() } catch (e) { console.log(e.message) }
try { await import('data:text/javascript,' + payload) } catch (e) { console.log(e.message) }Output:
% node --disallow-code-generation-from-strings 1.js
Code generation from strings disallowed for this context
Code generation from strings disallowed for this context
evaluated code from stringMetadata
Metadata
Assignees
Labels
No labels