cli: implement Node.js hardening flags (--disable-proto, --disallow-code-generation-from-strings, --frozen-intrinsics) - #35766
Open
robobun wants to merge 12 commits into
Open
cli: implement Node.js hardening flags (--disable-proto, --disallow-code-generation-from-strings, --frozen-intrinsics)#35766robobun wants to merge 12 commits into
robobun wants to merge 12 commits into
Claude / Claude Code Review
completed
Jul 25, 2026 in 23m 58s
Code review found 6 potential issues
Found 3 candidates, confirmed 6. See review comments for details.
Details
| Severity | Count |
|---|---|
| 🔴 Important | 0 |
| 🟡 Nit | 6 |
| 🟣 Pre-existing | 0 |
| Severity | File:Line | Issue |
|---|---|---|
| 🟡 Nit | src/js/internal/freeze_intrinsics.ts:66-76 |
--frozen-intrinsics leaves Float16Array unfrozen |
| 🟡 Nit | src/js/internal/process/pre_execution.ts:341-343 |
Typo in --frozen-intrinsics ExperimentalWarning: 'intristics' should be 'intrinsics' |
Annotations
Check warning on line 76 in src/js/internal/freeze_intrinsics.ts
claude / Claude Code Review
--frozen-intrinsics leaves Float16Array unfrozen
The typed-array lists omit `Float16Array`, which Bun/JSC exposes as a global (unlike Node.js, the port source) — so under `--frozen-intrinsics`, `Float16Array` and `Float16Array.prototype` are never frozen and `Float16Array.prototype.map = evil` succeeds while the identical assignment on `Float32Array.prototype` throws. Add `Float16Array.prototype` / `Float16Array` alongside `Float32Array` in both the `intrinsicPrototypes` list here and the `intrinsics` list at ~line 156 (optionally guarded like
Check warning on line 343 in src/js/internal/process/pre_execution.ts
claude / Claude Code Review
Typo in --frozen-intrinsics ExperimentalWarning: 'intristics' should be 'intrinsics'
Typo: `"Frozen intristics"` → `"Frozen intrinsics"`. Node.js's `emitExperimentalWarning('Frozen intrinsics')` produces the correctly-spelled message, and the PR description claims to emit "the same ExperimentalWarning as Node.js". The test only asserts `.toContain("ExperimentalWarning")` and `.toContain("experimental feature")`, so the typo passes CI unnoticed.
Loading