Author

Pete Bacon Darwin <pbacondarwin@cloudflare.com> 2026-03-19 11:25:31 +0000

Parents

56d6f44

Tree

8d38dc5

Tighten modifyCodeGenCallback to deny non-primitive non-string sources

Narrow the non-string source check from !IsString() to
!IsString() && !IsObject(), so only known-safe primitives
(undefined, null, boolean, number, bigint, symbol) are allowed
through. Object types are denied by default as a defense-in-depth
measure per review feedback.