Repository navigation
Add support for "--disallow-code-generation-from-strings" flag to workers #60371
Closed as not planned
Description
What is the problem this feature will solve?
I'm the creator and main maintainer of happy-dom. We recommend users to use the flags --disallow-code-generation-from-strings and --frozen-intrinsics when Javascript evaluation is enabled in happy-dom to make it harder for a potential attacker to escape a VM context and execute code at process level.
One of the packages uses Workers and it would be great if these flags could be sent in to "execArgv" when creating the Worker. It seems like --frozen-intrinsics is already supported.
What is the feature you are proposing to solve the problem?
Add support for --disallow-code-generation-from-strings to "execArgv" in Worker.
Example:
const worker = new Worker(new URL('ServerRendererWorker.js', import.meta.url), {
execArgv: ['--disallow-code-generation-from-strings']
});What alternatives have you considered?
No response
Activity
juanarbol commentedon Oct 22, 2025
I'll take a look, thanks! This is a very interesting feature request
juanarbol commentedon Oct 25, 2025
Based on docs
I'll ping @nodejs/workers, can I ask why aren't v8 options supported for a worker thread? Is there a feasible way to support them? Or at least a handful of them? This
--disallow-code-generation-from-stringsseems a quite interesting security feature -as OP mentioned-.Refs: https://nodejs.org/docs/latest/api/worker_threads.html#new-workerfilename-options
legendecas commentedon Nov 2, 2025
Most V8 flags are per process flags. Changing it for one worker thread will also change the flag value for other threads.
This per-process storage applies to
--disallow-code-generation-from-stringsas well. It is the default value for new context's code generation setting, for all threads.In addition,
--disallow-code-generation-from-stringsis not a security flag. It is implemented in V8 and only disallowsevalandnew Function: #58328capricorn86 commentedon Nov 3, 2025
Thank you for looking into this!
github-actions commentedon Jun 2, 2026
This issue has been marked as stale due to 210 days of inactivity.
It will be automatically closed in 30 days if no further activity occurs. If this is still relevant, please leave a comment or update it to keep it open.
github-actions commentedon Jul 3, 2026
This issue has been automatically closed after 30 days of inactivity following its stale status (no activity for a total of 240 days).
If this is still relevant, feel free to reopen it or leave a comment with additional details so we can continue the discussion.