Repository navigation
--disallow-code-generation-from-strings does not work as documented #58221
Description
Doc: https://nodejs.org/docs/latest/api/cli.html#--disallow-code-generation-from-strings
It is advertised to cover built-in language features, but it doesn't cover data imports
No Node.js modules are directly imported here
// run with node and node --disallow-code-generation-from-strings
const payload = 'console.log("evaluated code from string")'
try { eval(payload) } catch (e) { console.log(e.message) }
try { new Function(payload)() } catch (e) { console.log(e.message) }
try { await import('data:text/javascript,' + payload) } catch (e) { console.log(e.message) }Output:
% node --disallow-code-generation-from-strings 1.js
Code generation from strings disallowed for this context
Code generation from strings disallowed for this context
evaluated code from string
Activity
ChALkeR commentedon May 8, 2025
For comparison, this is what browsers do under CSP:
[-]--disallow-code-generation-from-strings does not work as advertised[/-][+]--disallow-code-generation-from-strings does not work as documented[/+]edilson258 commentedon May 10, 2025
wait, the official nodejs docs only covers
evalandnew Functionand those does not allow code from strings.In the example U brought, only the last line (bellow) executes the code even with the flag
--disallow-code-generation-from-stringssetand the docs does not cover that
refs: https://nodejs.org/docs/latest-v16.x/api/cli.html#--disallow-code-generation-from-strings
ChALkeR commentedon May 10, 2025
Doc states:
import()is a built-in language feature, defined in the ECMAScript specification.script-srcCSP for browsers blockingunsafe-eval, and that one blocks data imports too.import()as a dynamic eval defeats the purpose of this flag to a significant extentedilson258 commentedon May 11, 2025
@ChALkeR you are right!
@mojodna @bmizerany need your opinion about this please.
legendecas commentedon May 14, 2025
The flag
--disallow-code-generation-from-stringsonly covers features that are guarded by ECMA262 host hook HostEnsureCanCompileStrings. The exhausted API list iseval,new Function,ShadowRealm.prototype.evaluate(https://github.com/tc39/proposal-shadowrealm/).There are many APIs in Node.js' module system, and
node:vm, that allows creating script and modules dynamically. I think the doc for--disallow-code-generation-from-stringsshould also explicit exclude Node.js' module APIs.jimmywarting commentedon May 17, 2025
Um, maybe it should not cover that?
maybe
import()should be restricted instead to what you can and can't importsuch that you only allow imports from "self", http, https and no
data:urlgithub-actions commentedon Apr 20, 2026
This issue has been marked as stale due to 210 days of inactivity.
It will be automatically closed in 30 days if no further activity occurs. If this is still relevant, please leave a comment or update it to keep it open.
jendrikw commentedon Apr 20, 2026
not stale
github-actions commentedon Jul 20, 2026
This issue has been marked as stale due to 90 days of inactivity.
It will be automatically closed in 30 days if no further activity occurs. If this is still relevant, please leave a comment or update it to keep it open.
jendrikw commentedon Jul 23, 2026
bump