From 51e95ddcaddef70b21b5c70cae0544dceb221c97 Mon Sep 17 00:00:00 2001
From: Shelley Vohr <shelley.vohr@gmail.com>
Date: Wed, 23 Oct 2019 11:06:57 -0700
Subject: [PATCH] cli: whitelist new V8 flag in NODE_OPTIONS
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Explicitly whitelists --disallow-code-generation-from-strings in
NODE_OPTIONS as a new V8 flag. This flag prevents strings like eval()
from performing code generation.

PR-URL: https://github.com/nodejs/node/pull/30094
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Gireesh Punathil <gpunathi@in.ibm.com>
Reviewed-By: Gus Caplan <me@gus.host>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 doc/api/cli.md                         | 10 ++++++++++
 doc/node.1                             |  5 +++++
 src/node_options.cc                    |  4 ++++
 test/parallel/test-cli-node-options.js |  1 +
 4 files changed, 20 insertions(+)

diff --git a/doc/api/cli.md b/doc/api/cli.md
index c01a85b26dd9f5..5ed1ea72a21af0 100644
--- a/doc/api/cli.md
+++ b/doc/api/cli.md
@@ -127,6 +127,15 @@ added: v12.0.0
 
 Specify the file name of the CPU profile generated by `--cpu-prof`.
 
+### `--disallow-code-generation-from-strings`
+<!-- YAML
+added: v9.8.0
+-->
+
+Make built-in language features like `eval` and `new Function` that generate
+code from strings throw an exception instead. This does not affect the Node.js
+`vm` module.
+
 ### `--enable-fips`
 <!-- YAML
 added: v6.0.0
@@ -1085,6 +1094,7 @@ Node.js options that are allowed are:
 V8 options that are allowed are:
 <!-- node-options-v8 start -->
 * `--abort-on-uncaught-exception`
+* `--disallow-code-generation-from-strings`
 * `--interpreted-frames-native-stack`
 * `--max-old-space-size`
 * `--perf-basic-prof-only-functions`
diff --git a/doc/node.1 b/doc/node.1
index dc29867a699b3c..fdc2644d42e46e 100644
--- a/doc/node.1
+++ b/doc/node.1
@@ -100,6 +100,11 @@ The default is
 File name of the V8 CPU profile generated with
 .Fl -cpu-prof
 .
+.It Fl -disallow-code-generation-from-strings
+Make built-in language features like `eval` and `new Function` that generate
+code from strings throw an exception instead. This does not affect the Node.js
+`vm` module.
+.
 .It Fl -enable-fips
 Enable FIPS-compliant crypto at startup.
 Requires Node.js to be built with
diff --git a/src/node_options.cc b/src/node_options.cc
index 9371fc55622922..a54912c69310c5 100644
--- a/src/node_options.cc
+++ b/src/node_options.cc
@@ -594,6 +594,10 @@ PerIsolateOptionsParser::PerIsolateOptionsParser(
             V8Option{},
             kAllowedInEnvironment);
   AddOption("--stack-trace-limit", "", V8Option{}, kAllowedInEnvironment);
+  AddOption("--disallow-code-generation-from-strings",
+            "disallow eval and friends",
+            V8Option{},
+            kAllowedInEnvironment);
 
 #ifdef NODE_REPORT
   AddOption("--report-uncaught-exception",
diff --git a/test/parallel/test-cli-node-options.js b/test/parallel/test-cli-node-options.js
index 7e42139470e964..698f463b627644 100644
--- a/test/parallel/test-cli-node-options.js
+++ b/test/parallel/test-cli-node-options.js
@@ -60,6 +60,7 @@ if (common.hasCrypto) {
 
 // V8 options
 expect('--abort_on-uncaught_exception', 'B\n');
+expect('--disallow-code-generation-from-strings', 'B\n');
 expect('--max-old-space-size=0', 'B\n');
 expect('--stack-trace-limit=100',
        /(\s*at f \(\[eval\]:1:\d*\)\r?\n){100}/,