--disallow-code-generation-from-strings does not work as documented

Doc: https://nodejs.org/docs/latest/api/cli.html#--disallow-code-generation-from-strings

It is advertised to cover built-in language features, but it doesn't cover data imports

No Node.js modules are directly imported here

// run with node and node --disallow-code-generation-from-strings
const payload = 'console.log("evaluated code from string")'
try { eval(payload) } catch (e) { console.log(e.message) }
try { new Function(payload)() } catch (e) { console.log(e.message) }
try { await import('data:text/javascript,' + payload) } catch (e) { console.log(e.message) }

Output:

% node --disallow-code-generation-from-strings 1.js
Code generation from strings disallowed for this context
Code generation from strings disallowed for this context
evaluated code from string

使用 Node.js 以及 --disallow-code-generation-from-strings 运行 issue 的 1.js 复现，然后将 eval、new Function 和数据导入的结果与 issue 中链接的 CLI 文档进行比较。跟踪此选项对数据导入的处理；当观察到的行为符合文档所述的覆盖范围，并且三个案例都有回归覆盖时，即视为完成。