René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"`--disallow-code-generation-from-strings` breaks named import of re-exported CommonJS export","articleBody":"### Version\n\nv25.2.1\n\n### Platform\n\n```text\nLinux [...] 6.12.62-1-MANJARO #1 SMP PREEMPT_DYNAMIC Fri, 12 Dec 2025 19:00:00 +0000 x86_64 GNU/Linux\n```\n\n### Subsystem\n\n_No response_\n\n### What steps will reproduce the bug?\n\nMinimal example with three files, with `a.mjs` being entrypoint:\n\n`a.mjs`:\n```js\nimport { Hello } from \"./b.cjs\";\n\nHello();\n```\n\n`b.cjs`:\n```js\nmodule.exports = require(\"./c.cjs\");\n```\n\n`c.cjs`:\n```js\nfunction Hello() {\n    console.log(\"Hello, World!\");\n}\n\nmodule.exports = { Hello };\n```\n\n\n### How often does it reproduce? Is there a required condition?\n\nWith default flags works without issues, but if using `--disallow-code-generation-from-strings` the application breaks.\n\n### What is the expected behavior? Why is that the expected behavior?\n\nThe application should work as intended, as it doesn't use `eval` nor `new Function`:\n```\n$ node a.mjs\n```\n```\nHello, World!\n```\n\n### What do you see instead?\n\nThe application fails to run:\n```\n$ node --disallow-code-generation-from-strings a.mjs\n```\n```\nfile://[...]/a.mjs:1\nimport { Hello } from \"./b.cjs\";\n         ^^^^^\nSyntaxError: Named export 'Hello' not found. The requested module './b.cjs' is a CommonJS module, which may not support all module.exports as named exports.\nCommonJS modules can always be imported via the default export, for example using:\n\nimport pkg from './b.cjs';\nconst { Hello } = pkg;\n\n    at #asyncInstantiate (node:internal/modules/esm/module_job:302:21)\n    at async ModuleJob.run (node:internal/modules/esm/module_job:405:5)\n    at async onImport.tracePromise.__proto__ (node:internal/modules/esm/loader:654:26)\n    at async asyncRunEntryPointWithESMLoader (node:internal/modules/run_main:101:5)\n\nNode.js v25.2.1\n```\n\n### Additional information\n\nNote, that the above example is a simplification of real-world usecase, where `a.mjs` comes from an ESM application that imports `b.cjs` CommonJS library, which uses re-exports internally.\nMost notable case I stumbled upon of this happening is while using [express](https://www.npmjs.com/package/express).\n\nThere is a workaround for the application:\n`a_workaround.mjs`:\n```js\nimport b from \"./b.cjs\";\nconst { Hello } = b;\n\nHello();\n```\nBut this workaround is not always applicable (e.g. if using an ESM dependency outside our control that imports such CommonJS dependency itself) and from the meaning `--disallow-code-generation-from-strings` it is not clear why it should be needed. Even if the workaround is possible, the bug hampers usage of this hardening flag, even if the application nor the libraries make use of eval-like features.","author":{"url":"https://github.com/Mysak0CZ","@type":"Person","name":"Mysak0CZ"},"datePublished":"2025-12-15T23:25:51.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":4},"url":"https://github.com/61078/node/issues/61078"}