Deno/deno
1
0
Fork 0
mirror of https://github.com/denoland/deno.git synced 2024-11-22 04:51:22 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

fix(ops): add node.js env variable allowlist (#15893)

Browse Source 
This commit allows the Node compatibility layer to skip
environment variable permission checks when --unstable
is passed and the variable name is one that Node uses.

Fixes: https://github.com/denoland/deno/issues/15890
This commit is contained in:
Colin Ihrig 2022-09-14 11:59:20 -04:00 committed by GitHub
parent 7b98282993
commit 19deec4494
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
6 changed files with 42 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
cli/tests/integration/run_tests.rs
View File

@ -2839,3 +2839,15 @@ itest!(nested_error {
output: "nested_error.ts.out",
exit_code: 1,
});
itest!(node_env_var_allowlist_with_unstable_flag {
args: "run --unstable --no-prompt node_env_var_allowlist.ts",
output: "node_env_var_allowlist_with_unstable_flag.ts.out",
exit_code: 1,
});
itest!(node_env_var_allowlist_without_unstable_flag {
args: "run --no-prompt node_env_var_allowlist.ts",
output: "node_env_var_allowlist_without_unstable_flag.ts.out",
exit_code: 1,
});

2
cli/tests/testdata/node_env_var_allowlist.ts vendored Normal file
View File

@ -0,0 +1,2 @@
console.log(Deno.env.get("NODE_DEBUG") ?? "ok");
Deno.env.get("NOT_NODE_DEBUG");

5
cli/tests/testdata/node_env_var_allowlist_with_unstable_flag.ts.out vendored Normal file
View File

@ -0,0 +1,5 @@
ok
[WILDCARD]error: Uncaught PermissionDenied: Requires env access to "NOT_NODE_DEBUG", run again with the --allow-env flag
Deno.env.get("NOT_NODE_DEBUG");
^
at [WILDCARD]

4
cli/tests/testdata/node_env_var_allowlist_without_unstable_flag.ts.out vendored Normal file
View File

@ -0,0 +1,4 @@
[WILDCARD]error: Uncaught PermissionDenied: Requires env access to "NODE_DEBUG", run again with the --allow-env flag
console.log(Deno.env.get("NODE_DEBUG") ?? "ok");
^
at [WILDCARD]

10
ext/node/lib.rs
View File

@ -8,6 +8,7 @@ use deno_core::url::Url;
use deno_core::Extension;
use deno_core::OpState;
use once_cell::sync::Lazy;
use std::collections::HashSet;
use std::path::Path;
use std::path::PathBuf;
use std::rc::Rc;
@ -59,6 +60,15 @@ pub static NODE_GLOBAL_THIS_NAME: Lazy<String> = Lazy::new(|| {
format!("__DENO_NODE_GLOBAL_THIS_{}__", seconds)
});
pub static NODE_ENV_VAR_ALLOWLIST: Lazy<HashSet<String>> = Lazy::new(|| {
// The full list of environment variables supported by Node.js is available
// at https://nodejs.org/api/cli.html#environment-variables
let mut set = HashSet::new();
set.insert("NODE_DEBUG".to_string());
set.insert("NODE_OPTIONS".to_string());
set
});
struct Unstable(pub bool);
pub fn init<P: NodePermissions + 'static>(

10
runtime/ops/os.rs
View File

@ -8,6 +8,7 @@ use deno_core::url::Url;
use deno_core::Extension;
use deno_core::OpState;
use deno_core::{op, ExtensionBuilder};
use deno_node::NODE_ENV_VAR_ALLOWLIST;
use serde::Serialize;
use std::collections::HashMap;
use std::env;
@ -99,7 +100,14 @@ fn op_get_env(
state: &mut OpState,
key: String,
) -> Result<Option<String>, AnyError> {
state.borrow_mut::<Permissions>().env.check(&key)?;
let skip_permission_check =
state.borrow::<crate::ops::UnstableChecker>().unstable
&& NODE_ENV_VAR_ALLOWLIST.contains(&key);
if !skip_permission_check {
state.borrow_mut::<Permissions>().env.check(&key)?;
}
if key.is_empty() || key.contains(&['=', '\0'] as &[char]) {
return Err(type_error("Key contains invalid characters."));
}