Nodejs/node
1
0
Fork 0
mirror of https://github.com/nodejs/node.git synced 2024-11-21 10:59:27 +00:00
Code Issues Actions 25 Packages Projects Releases Wiki Activity

test,doc: clarify wildcard usage

Browse Source 
Follow-up: https://github.com/nodejs/node/pull/51209
PR-URL: https://github.com/nodejs-private/node-private/pull/517
Fixes: https://hackerone.com/bugs?subject=nodejs&report_id=2257156
CVE-ID: CVE-2024-21890
This commit is contained in:
RafaelGSS 2024-01-08 16:26:34 -03:00
parent 10ecf40067
commit 834ae3785b
2 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
doc/api/permissions.md
View File

@ -560,6 +560,9 @@ Wildcards are supported too:
* `--allow-fs-read=/home/test*` will allow read access to everything
that matches the wildcard. e.g: `/home/test/file1` or `/home/test2`
After passing a wildcard character (`*`) all subsequent characters will
be ignored. For example: `/home/*.js` will work similar to `/home/*`.
#### Permission Model constraints
There are constraints you need to know before using this system:

4
test/parallel/test-permission-fs-wildcard.js
View File

@ -107,11 +107,15 @@ if (common.isWindows) {
'--experimental-permission',
'--allow-fs-read=/a/b/*',
'--allow-fs-read=/a/b/d',
'--allow-fs-read=/etc/passwd.*',
'--allow-fs-read=/home/*.js',
'-e',
`
const assert = require('assert')
assert.ok(process.permission.has('fs.read', '/a/b/c'));
assert.ok(!process.permission.has('fs.read', '/a/c/c'));
assert.ok(!process.permission.has('fs.read', '/etc/passwd'));
assert.ok(process.permission.has('fs.read', '/home/another-file.md'));
`,
]
);