Please allow Javascript 'eval' functionality

[brr53]

I understand that 'eval' is disabled due to security concern.
However, please consider allowing the developer to decide if he/she wants to enable eval.

'Eval' is very useful in many NodeJS applications. I suggest perhaps just displaying a warning to developers who want to use eval instead of completely blocking the feature.

[jasnell]

For the production environment enabling eval, even optionally, runs the risk of security issues for the entire platform and not just the one worker. For local dev using workerd only, we do now have the UnsafeEval binding type that you can use (e.g. env.unsafe.eval('...') and env.unsafe.newFunction(...). There's a sample worker that shows how to use it.

[kentonv]

To elaborate, the security concern is that an attacker exploiting a zero-day in V8 can more easily cover their tracks, by only evaluating the exploit code dynamically. With the current restrictions, all code must be uploaded via our API and therefore can be subject to forensic analysis. In order to allow dynamic code evaluation, we'd have to come up with a scheme where we still have records of what was executed.