Status: New
Owner: ----
New issue 1258 by [email protected]: V8 should expose an API to disable
eval and other APIs that convert strings to code
http://code.google.com/p/v8/issues/detail?id=1258
We'd like to implement Content Security Policies in Chrome:
https://dvcs.w3.org/hg/content-security-policy/raw-file/1a29ed0d9fdc/csp-specification.dev.html
One of the requirements is that (under some circumstances), the user agent
must prevent strings from being converted to ECMAScript code:
https://dvcs.w3.org/hg/content-security-policy/raw-file/1a29ed0d9fdc/csp-specification.dev.html#code-must-not-be-created-from-strings
In order to implement this requirement, we need a V8 API to diable eval and
other ECMAScript APIs that convert strings into code (e.g., the Function
constructor).
Thanks!
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
