Skip to content

Commit

Permalink
cli: whitelist new V8 flag in NODE_OPTIONS
Browse files Browse the repository at this point in the history
Explicitly whitelists --disallow-code-generation-from-strings in
NODE_OPTIONS as a new V8 flag. This flag prevents strings like eval()
from performing code generation.

PR-URL: #30094
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Gireesh Punathil <gpunathi@in.ibm.com>
Reviewed-By: Gus Caplan <me@gus.host>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
  • Loading branch information
codebytere authored and MylesBorins committed Jan 12, 2020
1 parent 924a9a8 commit f3196db
Show file tree
Hide file tree
Showing 4 changed files with 20 additions and 0 deletions.
10 changes: 10 additions & 0 deletions doc/api/cli.md
Original file line number Diff line number Diff line change
Expand Up @@ -127,6 +127,15 @@ added: v12.0.0
Specify the file name of the CPU profile generated by `--cpu-prof`.

### `--disallow-code-generation-from-strings`
<!-- YAML
added: v9.8.0
-->

Make built-in language features like `eval` and `new Function` that generate
code from strings throw an exception instead. This does not affect the Node.js
`vm` module.

### `--enable-fips`
<!-- YAML
added: v6.0.0
Expand Down Expand Up @@ -1134,6 +1143,7 @@ Node.js options that are allowed are:
V8 options that are allowed are:
<!-- node-options-v8 start -->
* `--abort-on-uncaught-exception`
* `--disallow-code-generation-from-strings`
* `--interpreted-frames-native-stack`
* `--max-old-space-size`
* `--perf-basic-prof-only-functions`
Expand Down
5 changes: 5 additions & 0 deletions doc/node.1
Original file line number Diff line number Diff line change
Expand Up @@ -100,6 +100,11 @@ The default is
File name of the V8 CPU profile generated with
.Fl -cpu-prof
.
.It Fl -disallow-code-generation-from-strings
Make built-in language features like `eval` and `new Function` that generate
code from strings throw an exception instead. This does not affect the Node.js
`vm` module.
.
.It Fl -enable-fips
Enable FIPS-compliant crypto at startup.
Requires Node.js to be built with
Expand Down
4 changes: 4 additions & 0 deletions src/node_options.cc
Original file line number Diff line number Diff line change
Expand Up @@ -611,6 +611,10 @@ PerIsolateOptionsParser::PerIsolateOptionsParser(
V8Option{},
kAllowedInEnvironment);
AddOption("--stack-trace-limit", "", V8Option{}, kAllowedInEnvironment);
AddOption("--disallow-code-generation-from-strings",
"disallow eval and friends",
V8Option{},
kAllowedInEnvironment);

#ifdef NODE_REPORT
AddOption("--report-uncaught-exception",
Expand Down
1 change: 1 addition & 0 deletions test/parallel/test-cli-node-options.js
Original file line number Diff line number Diff line change
Expand Up @@ -60,6 +60,7 @@ if (common.hasCrypto) {

// V8 options
expect('--abort_on-uncaught_exception', 'B\n');
expect('--disallow-code-generation-from-strings', 'B\n');
expect('--max-old-space-size=0', 'B\n');
expect('--stack-trace-limit=100',
/(\s*at f \(\[eval\]:1:\d*\)\r?\n){100}/,
Expand Down

0 comments on commit f3196db

Please sign in to comment.