Code Generation From Strings Warning

JavaScript evaluation can be enabled in Happy DOM by setting the Browser setting enableJavaScriptEvaluation to "true". Happy DOM will output a warning in the console if JavaScript evaluation is enabled in an environment with code generation from strings (eval) enabled at process level.

A VM Context is not an isolated environment, and if you run untrusted JavaScript code you are at risk of RCE (Remote Code Execution) attacks. When code generation from strings (eval) is enabled at process level, it's possible to escape the VM Context and execute code at the process level.

This is currently the only known way to escape a VM Context that we know about, but there's always a risk with running untrusted JavaScript code within a VM Context, as it's not completely isolated.

How to fix this?

Option 1: Disable Code Generation From String in Node

You can disable code generation from strings (eval) by running Node with the "--disallow-code-generation-from-strings" flag.

eval() and Function will still work within the Happy DOM environment.

Example:

node --disallow-code-generation-from-strings ./index.js

or by setting an environment variable

export NODE_OPTIONS="--disallow-code-generation-from-strings"

Option 2: Keep JavaScript Evaluation Disabled

JavaScript evaluation is disabled by default in Happy DOM since v20.

Remove or set the setting enableJavaScriptEvaluation to "false" to disable JavaScript evaluation.

Option 3: Suppress Warning

Only ignore this warning if you trust the code that is executed within Happy DOM. JavaScript can be loaded from external sources or a developer in your project may copy and paste code from the internet with an attack.

To suppress the warning message you can set the setting suppressCodeGenerationFromStringsWarning to "true".

How is the attack performed?

All classes and functions inherit from Function. By walking the constructor chain it's possible to get hold of Function at process level. As Function can evaluate code from strings, it's possible to execute code at process level.

CommonJS (Possible to get hold of require)

const { Window } = require('happy-dom');
const window = new Window({ console });

window.document.write(`
  <script>
     const process = this.constructor.constructor('return process')();
     const require = process.mainModule.require;
  
     console.log('Files:', require('fs').readdirSync('.').slice(0,3));
  </script>
`);

ESM (Not possible to get hold of import or require)

const { Window } = require('happy-dom');
const window = new Window({ console });

window.document.write(`
  <script>
     const process = this.constructor.constructor('return process')();
  
     console.log('PID:', process.pid);
  </script>
`);