Open timkuijsten opened 2 months ago
I haven't looked at --frozen-intrinsics
since Node.js 18 ar whichit was an experimental feature that Node.js itself said would break code and I asked about this and they confirmed there was no solution yet. I see in your example you are also using Node.js 18. Can you see if it works on the latest Node.js, perhaps? If they still haven't fixed it, I will ask the Node.js project again if there is a solution yet.
$ ../node --frozen-intrinsics -e 'require("depd")("foo")'
/home/me/node-v20.14.0-linux-x64/bin/foo/node_modules/depd/index.js:268
var file = callSite.getFileName() || '<anonymous>'
^
TypeError: callSite.getFileName is not a function
at callSiteLocation (/home/me/node-v20.14.0-linux-x64/bin/foo/node_modules/depd/index.js:268:23)
at depd (/home/me/node-v20.14.0-linux-x64/bin/foo/node_modules/depd/index.js:109:14)
at [eval]:1:16
at runScriptInThisContext (node:internal/vm:209:10)
at node:internal/process/execution:118:14
at [eval]-wrapper:6:24
at runScript (node:internal/process/execution:101:62)
at evalScript (node:internal/process/execution:133:3)
at node:internal/main/eval_string:51:3
Node.js v20.14.0
The only difference is that the feature is no longer experimental in Node.js v20. (fwiw v22.3.0 yields the same result as v20).
Ok, thanks. When I get home tonight I will file another bug report on Node.js to see what the the solution is or to re make them aware it is still broken.
(note: this is a dupe of #50, but with a clear focus on security)
I've started to use the node
--frozen-intrinsics
option on more and more projects as recommended by the Node.js Security Best Practices because it mitigates the risk of monkey patching.When trying to run some 3rd party code that depends on depd it fails to start when the option is used:
I was wondering what the current status is for supporting this option?
See also the discussion around the
--disallow-code-generation-from-strings
security option in #41.