cli: implement Node.js hardening flags (--disable-proto, --disallow-code-generation-from-strings, --frozen-intrinsics) - #35766
Open
robobun wants to merge 12 commits into
Open
cli: implement Node.js hardening flags (--disable-proto, --disallow-code-generation-from-strings, --frozen-intrinsics)#35766robobun wants to merge 12 commits into
robobun wants to merge 12 commits into
Claude / Claude Code Review
completed
Jul 26, 2026 in 35m 58s
Code review found 2 important issues
Found 3 candidates, confirmed 2. See review comments for details.
Details
| Severity | Count |
|---|---|
| 🔴 Important | 2 |
| 🟡 Nit | 0 |
| 🟣 Pre-existing | 0 |
| Severity | File:Line | Issue |
|---|---|---|
| 🔴 Important | src/js/internal/freeze_intrinsics.ts:132 |
Two more unguarded-write sites reachable after freeze: util.getCallSites (Error.prepareStackTrace) and trace_events node |
Annotations
Check failure on line 132 in src/js/internal/freeze_intrinsics.ts
claude / Claude Code Review
Two more unguarded-write sites reachable after freeze: util.getCallSites (Error.prepareStackTrace) and trace_events node.console (console.*)
Two more sibling sites of the `Error.stackTraceLimit` sweep (cfc58159/82054866) still write to now-frozen intrinsics after the freeze: `util.getCallSites()` assigns `Error.prepareStackTrace` at src/js/node/util.ts:464/473 inside try/finally with no catch, and `installConsoleInstrumentation()` at src/js/internal/trace_events.ts:706-742 assigns `console.count/countReset/time/timeLog/timeEnd`. Under `--frozen-intrinsics`, `require('util').getCallSites()` and `require('trace_events').createTracing({
Loading