node:vm: report compileFunction body lines relative to lineOffset when it is 0 - #38240
Open
robobun wants to merge 9 commits into
Open
node:vm: report compileFunction body lines relative to lineOffset when it is 0#38240robobun wants to merge 9 commits into
robobun wants to merge 9 commits into
Claude / Claude Code Review
completed
Aug 13, 2026 in 17m 51s
Code review found 1 potential issue
Found 1 candidates, confirmed 1. See review comments for details.
Details
| Severity | Count |
|---|---|
| 🔴 Important | 0 |
| 🟡 Nit | 0 |
| 🟣 Pre-existing | 1 |
| Severity | File:Line | Issue |
|---|---|---|
| 🟣 Pre-existing | src/jsc/bindings/NodeVM.cpp:186-188 |
Pre-existing: compileFunction pre-parse checks first param instead of body when params are present |
Annotations
Check notice on line 188 in src/jsc/bindings/NodeVM.cpp
claude / Claude Code Review
Pre-existing: compileFunction pre-parse checks first param instead of body when params are present
Pre-existing (a0782cd1, not this PR), noting since it's a one-index fix in the same function: the injection-guard pre-parse at NodeVM.cpp:140-142 does `args.at(0).toWTFString(...)`, but `args` is `[param0, ..., paramN-1, body]`, so with any params it syntax-checks the first parameter name instead of the body. Consequence: `vm.compileFunction('});(function() {', ['a'])` bypasses the guard (Node throws SyntaxError, Bun returns an empty function), and `vm.compileFunction('%%', ['a'])` throws generi
Loading