feat: Add the option to disable generation from strings (#1222)

src/binding.cc

@@ -620,6 +620,10 @@ bool v8__Value__IsSetIterator(const v8::Value& self) {
   return self.IsSetIterator();
 }
 
+bool v8__Value__IsSetGeneratorObject(const v8::Value& self) {
+  return self.IsGeneratorObject();
+}
+
 bool v8__Value__IsWeakMap(const v8::Value& self) { return self.IsWeakMap(); }
 
 bool v8__Value__IsWeakSet(const v8::Value& self) { return self.IsWeakSet(); }
@@ -1768,6 +1772,14 @@ void v8__Context__UseDefaultSecurityToken(v8::Context& self) {
   ptr_to_local(&self)->UseDefaultSecurityToken();
 }
 
+void v8__Context__AllowCodeGenerationFromStrings(v8::Context& self, bool allow) {
+   ptr_to_local(&self)->AllowCodeGenerationFromStrings(allow); 
+}
+
+bool v8__Context_IsCodeGenerationFromStringsAllowed(v8::Context& self) {
+   return ptr_to_local(&self)->IsCodeGenerationFromStringsAllowed();
+}
+
 const v8::Context* v8__Context__FromSnapshot(v8::Isolate* isolate,
                                              size_t context_snapshot_index) {
   v8::MaybeLocal<v8::Context> maybe_local =

src/context.rs

@@ -48,6 +48,13 @@ extern "C" {
     value: *const Value,
   );
   pub(super) fn v8__Context__UseDefaultSecurityToken(this: *const Context);
+  pub(super) fn v8__Context__AllowCodeGenerationFromStrings(
+    this: *const Context,
+    allow: bool,
+  );
+  pub(super) fn v8__Context_IsCodeGenerationFromStringsAllowed(
+    this: *const Context,
+  ) -> bool;
 }
 
 impl Context {
@@ -351,6 +358,16 @@ impl Context {
       v8__Context__UseDefaultSecurityToken(self);
     }
   }
+
+  pub fn set_allow_generation_from_strings(&self, allow: bool) {
+    unsafe {
+      v8__Context__AllowCodeGenerationFromStrings(self, allow);
+    }
+  }
+
+  pub fn is_code_generation_from_strings_allowed(&self) -> bool {
+    unsafe { v8__Context_IsCodeGenerationFromStringsAllowed(self) }
+  }
 }
 
 struct ContextAnnex {

src/value.rs

@@ -52,6 +52,7 @@ extern "C" {
   fn v8__Value__IsSet(this: *const Value) -> bool;
   fn v8__Value__IsMapIterator(this: *const Value) -> bool;
   fn v8__Value__IsSetIterator(this: *const Value) -> bool;
+  fn v8__Value__IsSetGeneratorObject(this: *const Value) -> bool;
   fn v8__Value__IsWeakMap(this: *const Value) -> bool;
   fn v8__Value__IsWeakSet(this: *const Value) -> bool;
   fn v8__Value__IsArrayBuffer(this: *const Value) -> bool;
@@ -361,6 +362,12 @@ impl Value {
     unsafe { v8__Value__IsSetIterator(self) }
   }
 
+  /// Returns true if this value is a Generator Object.
+  #[inline(always)]
+  pub fn is_generator_object(&self) -> bool {
+    unsafe { v8__Value__IsSetGeneratorObject(self) }
+  }
+
   /// Returns true if this value is a WeakMap.
   #[inline(always)]
   pub fn is_weak_map(&self) -> bool {

tests/test_api.rs

@@ -3848,6 +3848,46 @@ fn security_token() {
   }
 }
 
+#[test]
+fn allow_code_generation_from_strings() {
+  let _setup_guard = setup::parallel_test();
+  let isolate = &mut v8::Isolate::new(Default::default());
+  {
+    let scope = &mut v8::HandleScope::new(isolate);
+    let context = v8::Context::new(scope);
+    // The code generation is allowed by default
+    assert!(context.is_code_generation_from_strings_allowed());
+    // This code will try to use generation from strings
+    let source = r#"
+     eval("const i = 1; i")
+    "#;
+    {
+      let scope = &mut v8::ContextScope::new(scope, context);
+
+      let try_catch = &mut v8::TryCatch::new(scope);
+      let result = eval(try_catch, source).unwrap();
+      let expected = v8::Integer::new(try_catch, 1);
+      assert!(expected.strict_equals(result));
+      assert!(!try_catch.has_caught());
+    }
+    context.set_allow_generation_from_strings(false);
+    assert!(!context.is_code_generation_from_strings_allowed());
+    {
+      let scope = &mut v8::ContextScope::new(scope, context);
+
+      let try_catch = &mut v8::TryCatch::new(scope);
+      let result = eval(try_catch, source);
+      assert!(try_catch.has_caught());
+      let exc = try_catch.exception().unwrap();
+      let exc = exc.to_string(try_catch).unwrap();
+      let exc = exc.to_rust_string_lossy(try_catch);
+      assert!(exc
+        .contains("Code generation from strings disallowed for this context"));
+      assert!(result.is_none());
+    }
+  }
+}
+
 #[test]
 fn allow_atomics_wait() {
   let _setup_guard = setup::parallel_test();
@@ -5268,6 +5308,22 @@ fn value_checker() {
     assert!(value == v8::Local::<v8::Object>::try_from(value).unwrap());
     assert!(value != v8::Object::new(scope));
 
+    let value = eval(
+      scope,
+      r#"
+    function* values() {
+      for (var i = 0; i < arguments.length; i++) {
+        yield arguments[i];
+      }
+    }
+    values(1, 2, 3)"#,
+    )
+    .unwrap();
+    assert!(value.is_generator_object());
+    assert!(value == value);
+    assert!(value == v8::Local::<v8::Object>::try_from(value).unwrap());
+    assert!(value != v8::Object::new(scope));
+
     let value = eval(scope, "new WeakMap()").unwrap();
     assert!(value.is_weak_map());
     assert!(value == value);