QuickJS: disabling eval() and string normalize.

external/njs_shell.c

@@ -2811,7 +2811,7 @@ njs_engine_qjs_init(njs_engine_t *engine, njs_opts_t *opts)
         return NJS_ERROR;
     }
 
-    engine->u.qjs.ctx = qjs_new_context(engine->u.qjs.rt);
+    engine->u.qjs.ctx = qjs_new_context(engine->u.qjs.rt, 1);
     if (engine->u.qjs.ctx == NULL) {
         njs_stderror("JS_NewContext() failed\n");
         return NJS_ERROR;

src/qjs.c

@@ -8,16 +8,30 @@
 
 
 JSContext *
-qjs_new_context(JSRuntime *rt)
+qjs_new_context(JSRuntime *rt, _Bool eval)
 {
     JSContext     *ctx;
     qjs_module_t  **module;
 
-    ctx = JS_NewContext(rt);
+    ctx = JS_NewContextRaw(rt);
     if (ctx == NULL) {
         return NULL;
     }
 
+    JS_AddIntrinsicBaseObjects(ctx);
+    JS_AddIntrinsicDate(ctx);
+    JS_AddIntrinsicRegExp(ctx);
+    JS_AddIntrinsicJSON(ctx);
+    JS_AddIntrinsicProxy(ctx);
+    JS_AddIntrinsicMapSet(ctx);
+    JS_AddIntrinsicTypedArrays(ctx);
+    JS_AddIntrinsicPromise(ctx);
+    JS_AddIntrinsicBigInt(ctx);
+
+    if (eval) {
+        JS_AddIntrinsicEval(ctx);
+    }
+
     for (module = qjs_modules; *module != NULL; module++) {
         if ((*module)->init(ctx, (*module)->name) == NULL) {
             return NULL;

src/qjs.h

@@ -39,7 +39,7 @@ typedef struct {
 } qjs_module_t;
 
 
-JSContext *qjs_new_context(JSRuntime *rt);
+JSContext *qjs_new_context(JSRuntime *rt, _Bool eval);
 
 
 JSValue qjs_buffer_alloc(JSContext *ctx, size_t size);