Please allow Javascript 'eval' functionality

[brr53]

I understand that 'eval' is disabled due to security concern.
However, please consider allowing the developer to decide if he/she wants to enable eval.

'Eval' is very useful in many NodeJS applications. I suggest perhaps just displaying a warning to developers who want to use eval instead of completely blocking the feature.

[jasnell]

For the production environment enabling eval, even optionally, runs the risk of security issues for the entire platform and not just the one worker. For local dev using workerd only, we do now have the UnsafeEval binding type that you can use (e.g. env.unsafe.eval('...') and env.unsafe.newFunction(...). There's a sample worker that shows how to use it.

[kentonv]

To elaborate, the security concern is that an attacker exploiting a zero-day in V8 can more easily cover their tracks, by only evaluating the exploit code dynamically. With the current restrictions, all code must be uploaded via our API and therefore can be subject to forensic analysis. In order to allow dynamic code evaluation, we'd have to come up with a scheme where we still have records of what was executed.

[sepbot]

@kentonv looks like i can run dynamically sourced code via browser rendering bindings. is this intentionally allowed because it's executed in a different context or just hasn't been locked down yet?

[jasnell]

We recently enabled the ability to run eval(...) and new Function(...) at the top-level scope in a worker. It is still forbidden while processing requests but when your worker is starting up it is allowed:

eval('1+1');  // ... works!

export default {
  fetch(req) {
    eval('1+1');  // throws
    return new Response('hello world');
  }
}