Skip to content

This issue was moved to a discussion.

You can continue the conversation there. Go to discussion →

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Please allow Javascript 'eval' functionality #1421

Closed
brr53 opened this issue Nov 21, 2023 · 1 comment
Closed

Please allow Javascript 'eval' functionality #1421

brr53 opened this issue Nov 21, 2023 · 1 comment

Comments

@brr53
Copy link

brr53 commented Nov 21, 2023

I understand that 'eval' is disabled due to security concern.
However, please consider allowing the developer to decide if he/she wants to enable eval.

'Eval' is very useful in many NodeJS applications. I suggest perhaps just displaying a warning to developers who want to use eval instead of completely blocking the feature.

@jasnell
Copy link
Member

jasnell commented Nov 22, 2023

For the production environment enabling eval, even optionally, runs the risk of security issues for the entire platform and not just the one worker. For local dev using workerd only, we do now have the UnsafeEval binding type that you can use (e.g. env.unsafe.eval('...') and env.unsafe.newFunction(...). There's a sample worker that shows how to use it.

@cloudflare cloudflare locked and limited conversation to collaborators Nov 22, 2023
@jasnell jasnell converted this issue into discussion #1432 Nov 22, 2023

This issue was moved to a discussion.

You can continue the conversation there. Go to discussion →

Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants