Author

Pete Bacon Darwin <pbacondarwin@cloudflare.com> 2026-03-17 15:06:51 +0000

Parents

b5dbc80

Tree

06ab7d5

Allow `new Function()` with no source when eval is blocked

When V8's code generation callback receives an undefined source (e.g.
`new Function()` with no arguments, or `class Foo extends Function {
constructor() { super(); } }`), there is no dynamic code to evaluate.
Allow these cases even when eval is otherwise blocked, since they pose
no code-injection risk.