From 4c5a5c64fbdb68f6ef5c4f23b34d429887ebb729 Mon Sep 17 00:00:00 2001
From: vdeturckheim <vlad2t@hotmail.com>
Date: Fri, 11 Sep 2020 19:20:48 +0200
Subject: [PATCH 1/2] process: introduce codeGenerationFromString event

The 'codeGenerationFromString' event is emitted
when a call is made to `eval` or `new Function`.

Co-authored-by: Thomas Watson <w@tson.dk>
---
 doc/api/process.md                            | 26 +++++++++
 lib/internal/bootstrap/node.js                | 20 +++++++
 src/node_process_methods.cc                   | 58 +++++++++++++++++++
 .../test-process-codegen-from-string.js       | 39 +++++++++++++
 4 files changed, 143 insertions(+)
 create mode 100644 test/parallel/test-process-codegen-from-string.js

diff --git a/doc/api/process.md b/doc/api/process.md
index 28db286bd90fd2..31dbff4d7b02fd 100644
--- a/doc/api/process.md
+++ b/doc/api/process.md
@@ -81,6 +81,32 @@ console.log('This message is displayed first.');
 // Process exit event with code: 0
 ```
 
+### Event: `'codeGenerationFromString'`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+The `'codeGenerationFromString'` event is emitted when a call is made to `eval(str)`
+or `new Function(str)`.
+The event will be emitted with the argument passed to `eval` or the
+`Function` constructor.
+The call to `eval` or `new Function` will happen after the event is emitted.
+
+```js
+process.on('codeGenerationFromString', (code) => {
+  console.log(`Generating code from string '${code}'`);
+});
+const item = { foo: 0 };
+eval('item.foo++');
+```
+
+will log
+
+```text
+Generating code from string 'item.foo++'
+```
+
 ### Event: `'disconnect'`
 
 <!-- YAML
diff --git a/lib/internal/bootstrap/node.js b/lib/internal/bootstrap/node.js
index b43fb2a5eb4b3a..89261f9bcbff06 100644
--- a/lib/internal/bootstrap/node.js
+++ b/lib/internal/bootstrap/node.js
@@ -371,6 +371,8 @@ process.emitWarning = emitWarning;
   // Note: only after this point are the timers effective
 }
 
+setupCodegenFromStringCallback(rawMethods);
+
 // Preload modules so that they are included in the builtin snapshot.
 require('fs');
 require('v8');
@@ -477,6 +479,24 @@ function createGlobalConsole(consoleFromVM) {
   return consoleFromNode;
 }
 
+function setupCodegenFromStringCallback(bindings) {
+  if (!bindings.codeGenerationFromStringsAllowed()) {
+    // Do nothing if code generation from strings is not allowed.
+    return;
+  }
+  const eventName = 'codeGenerationFromString';
+  process.on('newListener', (event) => {
+    if (event === eventName && process.listenerCount(eventName) === 0) {
+      bindings.setEmitCodeGenFromStringEvent(true);
+    }
+  });
+  process.on('removeListener', (event) => {
+    if (event === eventName && process.listenerCount(eventName) === 0) {
+      bindings.setEmitCodeGenFromStringEvent(false);
+    }
+  });
+}
+
 // https://heycam.github.io/webidl/#es-namespaces
 function exposeNamespace(target, name, namespaceObject) {
   ObjectDefineProperty(target, name, {
diff --git a/src/node_process_methods.cc b/src/node_process_methods.cc
index e4b16805586cb9..7ae2347c073c23 100644
--- a/src/node_process_methods.cc
+++ b/src/node_process_methods.cc
@@ -34,6 +34,7 @@ typedef int mode_t;
 
 namespace node {
 
+using errors::TryCatchScope;
 using v8::Array;
 using v8::ArrayBuffer;
 using v8::CFunction;
@@ -416,6 +417,57 @@ static void ReallyExit(const FunctionCallbackInfo<Value>& args) {
   env->Exit(code);
 }
 
+static void CodeGenerationFromStringsAllowed(
+                      const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+  Local<Context> context = env->context();
+  bool value = context->IsCodeGenerationFromStringsAllowed();
+  args.GetReturnValue().Set(value);
+}
+
+static v8::ModifyCodeGenerationFromStringsResult CodeGenCallback(
+    Local<Context> context,
+    Local<Value> source,
+    bool is_code_like) {
+  Environment* env = Environment::GetCurrent(context);
+  TryCatchScope try_catch(env);
+
+  ProcessEmit(env, "codeGenerationFromString", source);
+
+  // V8 does not expect this callback to have a scheduled exceptions once it
+  // returns, so we print them out in a best effort to do something about it
+  // without failing silently and without crashing the process.
+  if (try_catch.HasCaught() && !try_catch.HasTerminated()) {
+    Isolate* isolate = env->isolate();
+    fprintf(stderr, "Exception in codeGenerationFromString event callback:\n");
+    PrintCaughtException(isolate, env->context(), try_catch);
+  }
+
+  // returning {true, val} where val.IsEmpty() makes v8
+  // use the orignal value passed to `eval` which does not impact
+  // calls as `eval({})`
+  return {true, v8::MaybeLocal<v8::String>()};
+}
+
+static void SetEmitCodeGenFromStringEvent(
+      const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+  Isolate* isolate = args.GetIsolate();
+  Local<Context> context = env->context();
+
+  CHECK(args[0]->IsBoolean());
+
+  bool val = args[0]->BooleanValue(args.GetIsolate());
+  if (val) {
+    context->AllowCodeGenerationFromStrings(false);
+    isolate->SetModifyCodeGenerationFromStringsCallback(CodeGenCallback);
+  } else {
+    // This is enough to disable the handler. V8 will not call it anymore
+    // until set back to false
+    context->AllowCodeGenerationFromStrings(true);
+  }
+}
+
 namespace process {
 
 constexpr FastStringKey BindingData::type_name;
@@ -555,6 +607,10 @@ static void Initialize(Local<Object> target,
   env->SetMethod(target, "reallyExit", ReallyExit);
   env->SetMethodNoSideEffect(target, "uptime", Uptime);
   env->SetMethod(target, "patchProcessObject", PatchProcessObject);
+  env->SetMethod(target, "codeGenerationFromStringsAllowed",
+                 CodeGenerationFromStringsAllowed);
+  env->SetMethod(target, "setEmitCodeGenFromStringEvent",
+                 SetEmitCodeGenFromStringEvent);
 }
 
 void RegisterExternalReferences(ExternalReferenceRegistry* registry) {
@@ -582,6 +638,8 @@ void RegisterExternalReferences(ExternalReferenceRegistry* registry) {
   registry->Register(ReallyExit);
   registry->Register(Uptime);
   registry->Register(PatchProcessObject);
+  registry->Register(CodeGenerationFromStringsAllowed);
+  registry->Register(SetEmitCodeGenFromStringEvent);
 }
 
 }  // namespace process
diff --git a/test/parallel/test-process-codegen-from-string.js b/test/parallel/test-process-codegen-from-string.js
new file mode 100644
index 00000000000000..67d390c86b26f0
--- /dev/null
+++ b/test/parallel/test-process-codegen-from-string.js
@@ -0,0 +1,39 @@
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+
+const item = { foo: 0 };
+eval('++item.foo');
+
+assert.strictEqual(item.foo, 1);
+
+process.on('codeGenerationFromString', common.mustCall(handleError((code) => {
+  assert.strictEqual(code, 'item.foo++');
+})));
+
+eval('item.foo++');
+assert.strictEqual(item.foo, 2);
+
+process.removeAllListeners('codeGenerationFromString');
+
+process.on('codeGenerationFromString', common.mustCall(handleError((code) => {
+  assert.strictEqual(code, '(function anonymous(a,b\n) {\nreturn a + b\n})');
+})));
+
+const fct = new Function('a', 'b', 'return a + b');
+assert.strictEqual(fct(1, 2), 3);
+
+function handleError(fn) {
+  return (...args) => {
+    try {
+      fn(...args);
+    } catch (err) {
+      // The C++ code will just log the error to stderr and continue with the
+      // flow of the program. Set the exit code manually to ensure the test
+      // script fails in case of an error.
+      process.exitCode = 1;
+      throw err;
+    }
+  };
+}

From daeb37b44eab5d1e333d31aad092a7742117baae Mon Sep 17 00:00:00 2001
From: Thomas Watson <w@tson.dk>
Date: Tue, 30 Nov 2021 14:04:16 +0100
Subject: [PATCH 2/2] Update doc/api/process.md

Co-authored-by: James M Snell <jasnell@gmail.com>
---
 doc/api/process.md | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/doc/api/process.md b/doc/api/process.md
index 31dbff4d7b02fd..7fe9c11e88c1f5 100644
--- a/doc/api/process.md
+++ b/doc/api/process.md
@@ -89,8 +89,10 @@ added: REPLACEME
 
 The `'codeGenerationFromString'` event is emitted when a call is made to `eval(str)`
 or `new Function(str)`.
-The event will be emitted with the argument passed to `eval` or the
+
+The event handler callback will be invoked with the argument passed to `eval` or the
 `Function` constructor.
+
 The call to `eval` or `new Function` will happen after the event is emitted.
 
 ```js