doc: clarify the scope of --disallow-code-generation-from-strings

[legendecas]

Fixes: #58221

[ChALkeR]

No.

Documenting the incomplete behavior and setting it in stone would be more problematic, I think.

Instead, #28614 should have respected this flag

Not doing that that is hardly helpful and makes this flag close to useless.
While doing that will very unlikely break anything.

Also the path of least surprise in the behavior is blocking data imports on that flag, like browsers do with CSP.

See also explanation in #58221

[legendecas]

Node.js does not support CSP. This flag was originally exposed as a V8 flag, and documented in Node.js, only supporting guarding the listed APIs.

#28614 did nothing wrong as the flag was never meant to interfere module system, including require and import. Module APIs like module loaders (specifically the load hook, as it loads modules as source strings), require.extensions and CJS module._compile are all compiling module codes as string in JavaScript and I don't see it is possible to disable the whole module system for this flag.

[ChALkeR]

cc @nodejs/tsc pls discuss this

[aduh95]

Adding a request for change so this doesn't land without @ChALkeR's objection getting dismissed by either Nikita or a TSC vote.

[RaisinTen]

Commenting here too:
Not something that needs to be done here. To stress that this is a V8 option, we can move it under https://nodejs.org/api/cli.html#useful-v8-options.

[joyeecheung]

I think we should make it clear that it is a V8 flag and can change or be removed at any time. Node.js does not provide stability guarantee of this and it should not be used for security purposes. It only provides whatever V8 provides - it's okay to document what they are now the last time people checked, but we should also note that the documentation on the Node.js side may not be up to date.

If people are interested in a flag that does more than what the V8 flag does, IMO it's better to just implement a different flag that may or may not imply the V8 flag, depending on whether it's necessary/helpful.

[panva]

There's no need to list things it doesn't affect so long as there is a definitive list of what it does affect.

To that end, being clear about the exact language features being disallowed is important, words such as "like" in the text should be removed and an exhaustive list of disallowed features needs to be present with no room for misinterpretation.

Expanding the scope of the flag to disallow more non-v8 covered features is possible in a follow up contribution.