-
Notifications
You must be signed in to change notification settings - Fork 30.5k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Bug: Fail to disable eval() #44516
Comments
In order to propagate the Alternatively, the embedder can set its own callback of |
Thank you for the detailed explanation. In my use case, the application may allow-disallow-allow-disallow... the code generation from strings in one context. It seems setting |
Update I added the following line and it works. // After V8 isolate is initialized.
v8Isolate->SetModifyCodeGenerationFromStringsCallback(nullptr); |
VM里 通过 配置实现了 开启和禁用 这样操作 就把vm 的EVAL 彻底禁掉了 VM里是通过代码关闭的 |
Version
v16.17.0
Platform
Microsoft Windows NT 10.0.19044.0 x64
Subsystem
No response
What steps will reproduce the bug?
Background
I'm embedding Node.js in a C++ application and want to disable
eval()
for security concern.Reproduce
vcbuild.bat static without-intl
v8Context->AllowCodeGenerationFromStrings(false);
How often does it reproduce? Is there a required condition?
This is a consistent behavior malfunction. It doesn't require any conditions.
What is the expected behavior?
The expected result is calling
eval()
returns an errorEvalError: Code generation from strings disallowed for this context
. However, inv16.17.0
theeval()
still works. It used to be working well inv16.16.0
.What do you see instead?
The
eval()
is not disabled.Additional information
No response
The text was updated successfully, but these errors were encountered: