nodejs
diff --git a/Collapse file
‎common.gypi‎
Copy file name to clipboardExpand all lines: common.gypi
+1-1Lines changed: 1 addition & 1 deletion b/Collapse file
‎common.gypi‎
Copy file name to clipboardExpand all lines: common.gypi
+1-1Lines changed: 1 addition & 1 deletion
diff --git a/Collapse file
‎deps/v8/src/bootstrapper.cc‎
Copy file name to clipboardExpand all lines: deps/v8/src/bootstrapper.cc
+5Lines changed: 5 additions & 0 deletions b/Collapse file
‎deps/v8/src/bootstrapper.cc‎
Copy file name to clipboardExpand all lines: deps/v8/src/bootstrapper.cc
+5Lines changed: 5 additions & 0 deletions
diff --git a/Collapse file
‎deps/v8/src/flag-definitions.h‎
Copy file name to clipboardExpand all lines: deps/v8/src/flag-definitions.h
+2Lines changed: 2 additions & 0 deletions b/Collapse file
‎deps/v8/src/flag-definitions.h‎
Copy file name to clipboardExpand all lines: deps/v8/src/flag-definitions.h
+2Lines changed: 2 additions & 0 deletions
diff --git a/Collapse file
‎deps/v8/test/mjsunit/disallow-codegen-from-strings.js‎
Copy file name to clipboard
+9Lines changed: 9 additions & 0 deletions b/Collapse file
‎deps/v8/test/mjsunit/disallow-codegen-from-strings.js‎
Copy file name to clipboard
+9Lines changed: 9 additions & 0 deletions
@@ -27,7 +27,7 @@
 
     # Reset this number to 0 on major V8 upgrades.
     # Increment by one for each non-official patch applied to deps/v8.
-    'v8_embedder_string': '-node.20',
+    'v8_embedder_string': '-node.21',
 
     # Enable disassembler for `--print-code` v8 options
     'v8_enable_disassembler': 1,
 
@@ -5299,6 +5299,11 @@ Genesis::Genesis(
     if (!InstallDebuggerNatives()) return;
   }
 
+  if (FLAG_disallow_code_generation_from_strings) {
+    native_context()->set_allow_code_gen_from_strings(
+        isolate->heap()->false_value());
+  }
+
   ConfigureUtilsObject(context_type);
 
   // Check that the script context table is empty except for the 'this' binding.
 
@@ -732,6 +732,8 @@ DEFINE_BOOL(expose_trigger_failure, false, "expose trigger-failure extension")
 DEFINE_INT(stack_trace_limit, 10, "number of stack frames to capture")
 DEFINE_BOOL(builtins_in_stack_traces, false,
             "show built-in functions in stack traces")
+DEFINE_BOOL(disallow_code_generation_from_strings, false,
+            "disallow eval and friends")
 
 // builtins.cc
 DEFINE_BOOL(allow_unsafe_function_constructor, false,
 
@@ -0,0 +1,9 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --disallow-code-generation-from-strings
+
+assertThrows("1 + 1", EvalError);
+assertThrows(() => eval("1 + 1"), EvalError);
+assertThrows(() => Function("x", "return x + 1"), EvalError);