src: disable default eval (notable-change)

doc/api/cli.md

@@ -826,6 +826,16 @@ Set the default value of `order` in [`dns.lookup()`][] and
 The default is `verbatim` and [`dns.setDefaultResultOrder()`][] have higher
 priority than `--dns-result-order`.
 
+### `--enable-eval`
+
+<!-- YAML
+added: v26.0.0
+-->
+
+Enables the use of `eval()` and `new Function()`. By default, these are disabled
+for security reasons to prevent arbitrary code execution vulnerabilities. This
+does not affect the Node.js `node:vm` module.
+
 ### `--enable-fips`
 
 <!-- YAML

src/api/environment.cc

@@ -822,7 +822,8 @@ Maybe<void> InitializeContextRuntime(Local<Context> context) {
   // The `IsCodeGenerationFromStringsAllowed` can be refreshed by V8 according
   // to the runtime flags, propagate the value to the embedder data.
   bool is_code_generation_from_strings_allowed =
-      context->IsCodeGenerationFromStringsAllowed();
+      context->IsCodeGenerationFromStringsAllowed() &&
+      per_process::cli_options->per_isolate->enable_eval;
   context->AllowCodeGenerationFromStrings(false);
   context->SetEmbedderData(
       ContextEmbedderIndex::kAllowCodeGenerationFromStrings,
@@ -923,7 +924,7 @@ Maybe<void> InitializeMainContextForSnapshot(Local<Context> context) {
   context->SetEmbedderData(ContextEmbedderIndex::kAllowWasmCodeGeneration,
                            True(isolate));
   context->SetEmbedderData(
-      ContextEmbedderIndex::kAllowCodeGenerationFromStrings, True(isolate));
+      ContextEmbedderIndex::kAllowCodeGenerationFromStrings, False(isolate));
 
   if (InitializeBaseContextForSnapshot(context).IsNothing()) {
     return Nothing<void>();

src/node_errors.cc

@@ -659,8 +659,7 @@ v8::ModifyCodeGenerationFromStringsResult ModifyCodeGenerationFromStrings(
 
   Local<Value> allow_code_gen = context->GetEmbedderData(
       ContextEmbedderIndex::kAllowCodeGenerationFromStrings);
-  bool codegen_allowed =
-      allow_code_gen->IsUndefined() || allow_code_gen->IsTrue();
+  bool codegen_allowed = allow_code_gen->IsTrue();
   return {
       codegen_allowed,
       {},

src/node_options.cc

@@ -1206,6 +1206,11 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
 
 PerIsolateOptionsParser::PerIsolateOptionsParser(
   const EnvironmentOptionsParser& eop) {
+  AddOption("--enable-eval",
+            "explicitly enable eval() and Function() "
+            "(disabled by default for security)",
+            &PerIsolateOptions::enable_eval,
+            kAllowedInEnvvar);
   AddOption("--track-heap-objects",
             "track heap object allocations for heap snapshots",
             &PerIsolateOptions::track_heap_objects,

src/node_options.h

@@ -287,6 +287,7 @@ class PerIsolateOptions : public Options {
   PerIsolateOptions(PerIsolateOptions&&) = default;
 
   std::shared_ptr<EnvironmentOptions> per_env { new EnvironmentOptions() };
+  bool enable_eval = false;
   bool track_heap_objects = false;
   bool report_uncaught_exception = false;
   bool report_on_signal = false;

test/parallel/test-enable-eval-flag.js

@@ -0,0 +1,38 @@
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const { spawnSync } = require('child_process');
+
+const message = /Code generation from strings disallowed for this context/;
+
+// Check default behavior (blocked)
+// We test this in a subprocess to ensure a clean state
+const blockedChild = spawnSync(process.execPath, [
+  '-e',
+  'eval("1")'
+]);
+assert.notStrictEqual(blockedChild.status, 0);
+assert.match(blockedChild.stderr.toString(), message);
+
+// Check --enable-eval behavior (allowed)
+const allowedChild = spawnSync(process.execPath, [
+  '--enable-eval',
+  '-e',
+  'console.log(eval("1 + 1")); console.log(new Function("return 2")())'
+]);
+assert.strictEqual(allowedChild.status, 0);
+assert.strictEqual(allowedChild.stdout.toString().trim(), '2\n2');
+
+// Check behavior within the current process (should be blocked by default)
+assert.throws(() => eval('1'), {
+  name: 'EvalError',
+  message: message
+});
+
+assert.throws(() => new Function('return 1'), {
+  name: 'EvalError',
+  message: message
+});
+
+console.log('All tests passed');