Commit ba289ff
cli: whitelist new V8 flag in NODE_OPTIONS
Explicitly whitelists --disallow-code-generation-from-strings in
NODE_OPTIONS as a new V8 flag. This flag prevents strings like eval()
from performing code generation.
PR-URL: #30094
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Gireesh Punathil <gpunathi@in.ibm.com>
Reviewed-By: Gus Caplan <me@gus.host>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>1 parent 0517295 commit ba289ff
4 files changed
Lines changed: 20 additions & 0 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -127,6 +127,15 @@ added: v12.0.0 | |||
| 127 | 127 | ||
| 128 | 128 | Specify the file name of the CPU profile generated by `--cpu-prof`. | |
| 129 | 129 | ||
| 130 | + ### `--disallow-code-generation-from-strings` | ||
| 131 | + <!-- YAML | ||
| 132 | + added: v9.8.0 | ||
| 133 | + --> | ||
| 134 | + | ||
| 135 | + Make built-in language features like `eval` and `new Function` that generate | ||
| 136 | + code from strings throw an exception instead. This does not affect the Node.js | ||
| 137 | + `vm` module. | ||
| 138 | + | ||
| 130 | 139 | ### `--enable-fips` | |
| 131 | 140 | <!-- YAML | |
| 132 | 141 | added: v6.0.0 | |
@@ -1145,6 +1154,7 @@ Node.js options that are allowed are: | |||
| 1145 | 1154 | V8 options that are allowed are: | |
| 1146 | 1155 | <!-- node-options-v8 start --> | |
| 1147 | 1156 | * `--abort-on-uncaught-exception` | |
| 1157 | + * `--disallow-code-generation-from-strings` | ||
| 1148 | 1158 | * `--interpreted-frames-native-stack` | |
| 1149 | 1159 | * `--max-old-space-size` | |
| 1150 | 1160 | * `--perf-basic-prof-only-functions` | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -100,6 +100,11 @@ The default is | |||
| 100 | 100 | File name of the V8 CPU profile generated with | |
| 101 | 101 | .Fl -cpu-prof | |
| 102 | 102 | . | |
| 103 | + .It Fl -disallow-code-generation-from-strings | ||
| 104 | + Make built-in language features like `eval` and `new Function` that generate | ||
| 105 | + code from strings throw an exception instead. This does not affect the Node.js | ||
| 106 | + `vm` module. | ||
| 107 | + . | ||
| 103 | 108 | .It Fl -enable-fips | |
| 104 | 109 | Enable FIPS-compliant crypto at startup. | |
| 105 | 110 | Requires Node.js to be built with | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -615,6 +615,10 @@ PerIsolateOptionsParser::PerIsolateOptionsParser( | |||
| 615 | 615 | V8Option{}, | |
| 616 | 616 | kAllowedInEnvironment); | |
| 617 | 617 | AddOption("--stack-trace-limit", "", V8Option{}, kAllowedInEnvironment); | |
| 618 | + AddOption("--disallow-code-generation-from-strings", | ||
| 619 | + "disallow eval and friends", | ||
| 620 | + V8Option{}, | ||
| 621 | + kAllowedInEnvironment); | ||
| 618 | 622 | ||
| 619 | 623 | #ifdef NODE_REPORT | |
| 620 | 624 | AddOption("--report-uncaught-exception", | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -60,6 +60,7 @@ if (common.hasCrypto) { | |||
| 60 | 60 | ||
| 61 | 61 | // V8 options | |
| 62 | 62 | expect('--abort_on-uncaught_exception', 'B\n'); | |
| 63 | + expect('--disallow-code-generation-from-strings', 'B\n'); | ||
| 63 | 64 | expect('--max-old-space-size=0', 'B\n'); | |
| 64 | 65 | expect('--stack-trace-limit=100', | |
| 65 | 66 | /(\s*at f \(\[eval\]:1:\d*\)\r?\n){100}/, | |
0 commit comments