Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

--disallow-code-generation-from-strings is ignored since versions 16.17 and 18.6 #44287

Closed
Recursing opened this issue Aug 19, 2022 · 2 comments · Fixed by #44324
Closed

--disallow-code-generation-from-strings is ignored since versions 16.17 and 18.6 #44287

Recursing opened this issue Aug 19, 2022 · 2 comments · Fixed by #44324

Comments

@Recursing
Copy link

Recursing commented Aug 19, 2022

Version

v18.7.0, v18.6.0, v16.17.0

Platform

18.04.1-Ubuntu SMP and Darwin Kernel Version 20.6.0

What steps will reproduce the bug?

$ node --disallow-code-generation-from-strings
Welcome to Node.js v16.17.0.
Type ".help" for more information.
> eval("1+2")
3

What is the expected behavior?

The expected behavior is:

"built-in language features like eval and new Function that generate code from strings throw an exception instead."

As per the documentation

Like in node 16.16:

$ node --disallow-code-generation-from-strings
Welcome to Node.js v16.16.0.
Type ".help" for more information.
> eval("1+2")
Uncaught EvalError: Code generation from strings disallowed for this context

What do you see instead?

$ node --disallow-code-generation-from-strings                                                   09:34
Welcome to Node.js v18.7.0.
Type ".help" for more information.
> eval("1+2")
3

Additional information

Has the flag been deprecated? Is there a new flag we can use? I couldn't find any documentation about this change.

It works correctly in versions 16.16 and 18.5, but seems ignored in versions 16.17, 18.6, and 18.7.

@Recursing Recursing changed the title Regression: --disallow-code-generation-from-strings is ignored since version 16.17 and 18.6 Regression: --disallow-code-generation-from-strings is ignored since versions 16.17 and 18.6 Aug 19, 2022
@Recursing Recursing changed the title Regression: --disallow-code-generation-from-strings is ignored since versions 16.17 and 18.6 --disallow-code-generation-from-strings is ignored since versions 16.17 and 18.6 Aug 19, 2022
@targos
Copy link
Member

targos commented Aug 19, 2022

I suspect 02eb10b

/cc @legendecas

@legendecas
Copy link
Member

legendecas commented Aug 19, 2022

Looks like we'll need to restore the default value set in v8: https://source.chromium.org/chromium/chromium/src/+/main:v8/src/init/bootstrapper.cc;l=6511?q=FLAG_disallow_code_generation_from_strings. I'll submit a fix for this. Thank you for reporting this.

nodejs-github-bot pushed a commit that referenced this issue Aug 28, 2022
Context's default IsCodeGenerationFromStringsAllowed value can be
changed by v8 flag `--disallow-code-generation-from-strings`. Restore
the value at runtime when delegating the code generation validation to
`node::ModifyCodeGenerationFromStrings`.

The context's settings are serialized in the snapshot. Reset the setting
values to its default values before the serialization so that it can be
correctly re-initialized after deserialization at runtime.

PR-URL: #44324
Fixes: #44287
Reviewed-By: Joyee Cheung <[email protected]>
Reviewed-By: James M Snell <[email protected]>
RafaelGSS pushed a commit that referenced this issue Sep 5, 2022
Context's default IsCodeGenerationFromStringsAllowed value can be
changed by v8 flag `--disallow-code-generation-from-strings`. Restore
the value at runtime when delegating the code generation validation to
`node::ModifyCodeGenerationFromStrings`.

The context's settings are serialized in the snapshot. Reset the setting
values to its default values before the serialization so that it can be
correctly re-initialized after deserialization at runtime.

PR-URL: #44324
Fixes: #44287
Reviewed-By: Joyee Cheung <[email protected]>
Reviewed-By: James M Snell <[email protected]>
Fyko pushed a commit to Fyko/node that referenced this issue Sep 15, 2022
Context's default IsCodeGenerationFromStringsAllowed value can be
changed by v8 flag `--disallow-code-generation-from-strings`. Restore
the value at runtime when delegating the code generation validation to
`node::ModifyCodeGenerationFromStrings`.

The context's settings are serialized in the snapshot. Reset the setting
values to its default values before the serialization so that it can be
correctly re-initialized after deserialization at runtime.

PR-URL: nodejs#44324
Fixes: nodejs#44287
Reviewed-By: Joyee Cheung <[email protected]>
Reviewed-By: James M Snell <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants