--disallow-code-generation-from-strings does not work as documented

Doc: https://nodejs.org/docs/latest/api/cli.html#--disallow-code-generation-from-strings

It is advertised to cover built-in language features, but it doesn't cover data imports

No Node.js modules are directly imported here

// run with node and node --disallow-code-generation-from-strings
const payload = 'console.log("evaluated code from string")'
try { eval(payload) } catch (e) { console.log(e.message) }
try { new Function(payload)() } catch (e) { console.log(e.message) }
try { await import('data:text/javascript,' + payload) } catch (e) { console.log(e.message) }

Output:

% node --disallow-code-generation-from-strings 1.js
Code generation from strings disallowed for this context
Code generation from strings disallowed for this context
evaluated code from string

Ejecuta la reproducción 1.js del issue con Node.js y con --disallow-code-generation-from-strings, y compara los resultados de eval, new Function y las importaciones de datos con la documentación de CLI enlazada en el issue. Rastrea el manejo de esta opción para las importaciones de datos; se considera terminado cuando el comportamiento observado coincide con la cobertura documentada y existe cobertura de regresión para los tres casos.