Polyglot options not working consistently with JS about graaljs HOT 2 CLOSED

This is a misunderstanding. Note that the help/documentation of the option says

--js.allow-eval=true|false   Allow or disallow code generation from strings, e.g. using eval(). 

Your example invokes eval() with a number argument. When eval() is invoked with non-string argument then this argument becomes the return value (and no "code generation from string" occurs). Try eval("600+16") instead of eval(600+16) to see the difference.

from graaljs.

This is a misunderstanding. Note that the help/documentation of the option says

--js.allow-eval=true|false   Allow or disallow code generation from strings, e.g. using eval(). 

Your example invokes eval() with a number argument. When eval() is invoked with non-string argument then this argument becomes the return value (and no "code generation from string" occurs). Try eval("600+16") instead of eval(600+16) to see the difference.

Wow, I can't believe I missed that. I totally get what the doc says now, thank you! I don't know if it'd be worth adding examples to the doc to avoid this kind of misunderstandings, although I think my ESL is what's mostly to blame.

For all intents and purposes if eval cannot evaluate strings, that should be enough to satisfy my "disallow using eval" requirement as I can't come up with a scenario where evaluating non-string arguments with eval might result in a security concern, as usual though, there might be.

Anyways, thank you again, I appreciate the clarification :)

from graaljs.