Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

--disallow-code-generation-from-strings is ignored since versions 16.17 and 18.6 #44287

Closed
Recursing opened this issue Aug 19, 2022 · 2 comments · Fixed by #44324
Closed

--disallow-code-generation-from-strings is ignored since versions 16.17 and 18.6 #44287

Recursing opened this issue Aug 19, 2022 · 2 comments · Fixed by #44324

Comments

@Recursing
Copy link

Recursing commented Aug 19, 2022 •
edited by VoltrexKeyva
Loading

Version

v18.7.0, v18.6.0, v16.17.0

Platform

18.04.1-Ubuntu SMP and Darwin Kernel Version 20.6.0

What steps will reproduce the bug?

$ node --disallow-code-generation-from-strings
Welcome to Node.js v16.17.0.
Type ".help" for more information.
> eval("1+2")
3

What is the expected behavior?

The expected behavior is:

"built-in language features like eval and new Function that generate code from strings throw an exception instead."

As per the documentation

Like in node 16.16:

$ node --disallow-code-generation-from-strings
Welcome to Node.js v16.16.0.
Type ".help" for more information.
> eval("1+2")
Uncaught EvalError: Code generation from strings disallowed for this context

What do you see instead?

$ node --disallow-code-generation-from-strings                                                   09:34
Welcome to Node.js v18.7.0.
Type ".help" for more information.
> eval("1+2")
3

Additional information

Has the flag been deprecated? Is there a new flag we can use? I couldn't find any documentation about this change.

It works correctly in versions 16.16 and 18.5, but seems ignored in versions 16.17, 18.6, and 18.7.
@Recursing Recursing changed the title Regression: --disallow-code-generation-from-strings is ignored since version 16.17 and 18.6 Regression: --disallow-code-generation-from-strings is ignored since versions 16.17 and 18.6 Aug 19, 2022
@Recursing Recursing changed the title Regression: --disallow-code-generation-from-strings is ignored since versions 16.17 and 18.6 --disallow-code-generation-from-strings is ignored since versions 16.17 and 18.6 Aug 19, 2022
@targos
Copy link
Member

targos commented Aug 19, 2022

I suspect 02eb10b

/cc @legendecas

@legendecas
Copy link
Member

legendecas commented Aug 19, 2022 •
edited
Loading

Looks like we'll need to restore the default value set in v8: https://source.chromium.org/chromium/chromium/src/+/main:v8/src/init/bootstrapper.cc;l=6511?q=FLAG_disallow_code_generation_from_strings. I'll submit a fix for this. Thank you for reporting this.

@legendecas legendecas mentioned this issue Aug 21, 2022
Merged
nodejs-github-bot pushed a commit that referenced this issue Aug 28, 2022
@legendecas
src: restore context default IsCodeGenerationFromStringsAllowed value
3370e7c 
Context's default IsCodeGenerationFromStringsAllowed value can be
changed by v8 flag `--disallow-code-generation-from-strings`. Restore
the value at runtime when delegating the code generation validation to
`node::ModifyCodeGenerationFromStrings`.

The context's settings are serialized in the snapshot. Reset the setting
values to its default values before the serialization so that it can be
correctly re-initialized after deserialization at runtime.

PR-URL: #44324
Fixes: #44287
Reviewed-By: Joyee Cheung <[email protected]>
Reviewed-By: James M Snell <[email protected]>
RafaelGSS pushed a commit that referenced this issue Sep 5, 2022
@legendecas @RafaelGSS
src: restore context default IsCodeGenerationFromStringsAllowed value
0f4e98b 
Context's default IsCodeGenerationFromStringsAllowed value can be
changed by v8 flag `--disallow-code-generation-from-strings`. Restore
the value at runtime when delegating the code generation validation to
`node::ModifyCodeGenerationFromStrings`.

The context's settings are serialized in the snapshot. Reset the setting
values to its default values before the serialization so that it can be
correctly re-initialized after deserialization at runtime.

PR-URL: #44324
Fixes: #44287
Reviewed-By: Joyee Cheung <[email protected]>
Reviewed-By: James M Snell <[email protected]>
Fyko pushed a commit to Fyko/node that referenced this issue Sep 15, 2022
@legendecas @Fyko
src: restore context default IsCodeGenerationFromStringsAllowed value
fd050c7 
Context's default IsCodeGenerationFromStringsAllowed value can be
changed by v8 flag `--disallow-code-generation-from-strings`. Restore
the value at runtime when delegating the code generation validation to
`node::ModifyCodeGenerationFromStrings`.

The context's settings are serialized in the snapshot. Reset the setting
values to its default values before the serialization so that it can be
correctly re-initialized after deserialization at runtime.

PR-URL: nodejs#44324
Fixes: nodejs#44287
Reviewed-By: Joyee Cheung <[email protected]>
Reviewed-By: James M Snell <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

src: restore context default IsCodeGenerationFromStringsAllowed value legendecas/node
3 participants
@targos @Recursing @legendecas