GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — src,lib: stabilize permission model · nodejs/node@57bb983

File tree

Expand file treeCollapse file tree

Open diff view settings

Filter options

benchmark
- fs
  - readfile-permission-enabled.js
- permission
  - permission-processhas-fs-read.js
  - permission-startup.js
doc
- api
- node.1
lib/internal/process
- permission.js
- pre_execution.js
src
test
tools
- run-worker.js

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

Dismiss banner

Expand file treeCollapse file tree

Open diff view settings

Collapse file

`‎benchmark/fs/readfile-permission-enabled.js‎`

Copy file name to clipboardExpand all lines: benchmark/fs/readfile-permission-enabled.js

+1-1Lines changed: 1 addition & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -17,7 +17,7 @@ const bench = common.createBenchmark(main, {`
`17`	`17`	`concurrent: [1, 10],`
`18`	`18`	`}, {`
`19`	`19`	`flags: [`
`20`		`- '--experimental-permission',`
	`20`	`+ '--permission',`
`21`	`21`	`'--allow-fs-read=*',`
`22`	`22`	`'--allow-fs-write=*',`
`23`	`23`	`'--allow-child-process',`

Collapse file

`‎benchmark/permission/permission-processhas-fs-read.js‎`

Copy file name to clipboardExpand all lines: benchmark/permission/permission-processhas-fs-read.js

+1-1Lines changed: 1 addition & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -11,7 +11,7 @@ const rootPath = path.resolve(__dirname, '../../..');`
`11`	`11`
`12`	`12`	`const options = {`
`13`	`13`	`flags: [`
`14`		`- '--experimental-permission',`
	`14`	`+ '--permission',`
`15`	`15`	`--allow-fs-read=${rootPath}`,
`16`	`16`	`'--allow-child-process',`
`17`	`17`	`'--no-warnings',`

Collapse file

`‎benchmark/permission/permission-startup.js‎`

Copy file name to clipboardExpand all lines: benchmark/permission/permission-startup.js

+1-1Lines changed: 1 addition & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -48,7 +48,7 @@ function spawnProcess(script, bench, state) {`
`48`	`48`	`function main({ count, script, nFiles, prefixPath }) {`
`49`	`49`	script = path.resolve(__dirname, '../../', `${script}.js`);
`50`	`50`	`const optionsWithScript = [`
`51`		`- '--experimental-permission',`
	`51`	`+ '--permission',`
`52`	`52`	`--allow-fs-read=${script}`,
`53`	`53`	`...mockFiles(nFiles, prefixPath).map((file) => '--allow-fs-read=' + file),`
`54`	`54`	`script,`

Collapse file

`‎doc/api/cli.md‎`

Copy file name to clipboardExpand all lines: doc/api/cli.md

+37-26Lines changed: 37 additions & 26 deletions

Display the source diff
Display the rich diff

Original file line number	Diff line number	Diff line change
`@@ -126,7 +126,7 @@ require('nodejs-addon-example');`
`126`	`126`	```
`127`	`127`
`128`	`128`	```console
`129`		`-$ node --experimental-permission --allow-fs-read=* index.js`
	`129`	`+$ node --permission --allow-fs-read=* index.js`
`130`	`130`	`node:internal/modules/cjs/loader:1319`
`131`	`131`	`return process.dlopen(module, path.toNamespacedPath(filename));`
`132`	`132`	`^`
`@@ -168,7 +168,7 @@ childProcess.spawn('node', ['-e', 'require("fs").writeFileSync("/new-file", "exa`
`168`	`168`	```
`169`	`169`
`170`	`170`	```console
`171`		`-$ node --experimental-permission --allow-fs-read=* index.js`
	`171`	`+$ node --permission --allow-fs-read=* index.js`
`172`	`172`	`node:internal/child_process:388`
`173`	`173`	`const err = this._handle.spawn(options);`
`174`	`174`	`^`
`@@ -192,12 +192,15 @@ Error: Access to this API has been restricted`
`192`	`192`	`<!-- YAML`
`193`	`193`	`added: v20.0.0`
`194`	`194`	`changes:`
	`195`	`+ - version: REPLACEME`
	`196`	`+ pr-url: https://github.com/nodejs/node/pull/56201`
	`197`	`+ description: Permission Model and --allow-fs flags are stable.`
`195`	`198`	`- version: v20.7.0`
`196`	`199`	`pr-url: https://github.com/nodejs/node/pull/49047`
`197`	`200`	description: Paths delimited by comma (`,`) are no longer allowed.
`198`	`201`	`-->`
`199`	`202`
`200`		`-> Stability: 1.1 - Active development`
	`203`	`+> Stability: 2 - Stable.`
`201`	`204`
`202`	`205`	`This flag configures file system read permissions using`
`203`	`206`	`the [Permission Model][].`
`@@ -213,7 +216,7 @@ Examples can be found in the [File System Permissions][] documentation.`
`213`	`216`	`The initializer module also needs to be allowed. Consider the following example:`
`214`	`217`
`215`	`218`	```console
`216`		`-$ node --experimental-permission index.js`
	`219`	`+$ node --permission index.js`
`217`	`220`
`218`	`221`	`Error: Access to this API has been restricted`
`219`	`222`	`at node:internal/main/run_main_module:23:47 {`
`@@ -226,20 +229,23 @@ Error: Access to this API has been restricted`
`226`	`229`	The process needs to have access to the `index.js` module:
`227`	`230`
`228`	`231`	```bash
`229`		`-node --experimental-permission --allow-fs-read=/path/to/index.js index.js`
	`232`	`+node --permission --allow-fs-read=/path/to/index.js index.js`
`230`	`233`	```
`231`	`234`
`232`	`235`	### `--allow-fs-write`
`233`	`236`
`234`	`237`	`<!-- YAML`
`235`	`238`	`added: v20.0.0`
`236`	`239`	`changes:`
	`240`	`+ - version: REPLACEME`
	`241`	`+ pr-url: https://github.com/nodejs/node/pull/56201`
	`242`	`+ description: Permission Model and --allow-fs flags are stable.`
`237`	`243`	`- version: v20.7.0`
`238`	`244`	`pr-url: https://github.com/nodejs/node/pull/49047`
`239`	`245`	description: Paths delimited by comma (`,`) are no longer allowed.
`240`	`246`	`-->`
`241`	`247`
`242`		`-> Stability: 1.1 - Active development`
	`248`	`+> Stability: 2 - Stable.`
`243`	`249`
`244`	`250`	`This flag configures file system write permissions using`
`245`	`251`	`the [Permission Model][].`
`@@ -283,7 +289,7 @@ new WASI({`
`283`	`289`	```
`284`	`290`
`285`	`291`	```console
`286`		`-$ node --experimental-permission --allow-fs-read=* index.js`
	`292`	`+$ node --permission --allow-fs-read=* index.js`
`287`	`293`
`288`	`294`	`Error: Access to this API has been restricted`
`289`	`295`	`at node:internal/main/run_main_module:30:49 {`
`@@ -314,7 +320,7 @@ new Worker(__filename);`
`314`	`320`	```
`315`	`321`
`316`	`322`	```console
`317`		`-$ node --experimental-permission --allow-fs-read=* index.js`
	`323`	`+$ node --permission --allow-fs-read=* index.js`
`318`	`324`
`319`	`325`	`Error: Access to this API has been restricted`
`320`	`326`	`at node:internal/main/run_main_module:17:47 {`
`@@ -970,24 +976,6 @@ added:`
`970`	`976`
`971`	`977`	`Enable experimental support for the network inspection with Chrome DevTools.`
`972`	`978`
`973`		-### `--experimental-permission`
`974`		`-`
`975`		`-<!-- YAML`
`976`		`-added: v20.0.0`
`977`		`--->`
`978`		`-`
`979`		`-> Stability: 1.1 - Active development`
`980`		`-`
`981`		`-Enable the Permission Model for current process. When enabled, the`
`982`		`-following permissions are restricted:`
`983`		`-`
`984`		`-* File System - manageable through`
`985`		- [`--allow-fs-read`][], [`--allow-fs-write`][] flags
`986`		-* Child Process - manageable through [`--allow-child-process`][] flag
`987`		-* Worker Threads - manageable through [`--allow-worker`][] flag
`988`		-* WASI - manageable through [`--allow-wasi`][] flag
`989`		-* Addons - manageable through [`--allow-addons`][] flag
`990`		`-`
`991`	`979`	### `--experimental-print-required-tla`
`992`	`980`
`993`	`981`	`<!-- YAML`
@@ -1807,6 +1795,28 @@ unless either the `--pending-deprecation` command-line flag, or the
`1807`	`1795`	`are used to provide a kind of selective "early warning" mechanism that`
`1808`	`1796`	`developers may leverage to detect deprecated API usage.`
`1809`	`1797`
	`1798`	+### `--permission`
	`1799`	`+`
	`1800`	`+<!-- YAML`
	`1801`	`+added: v20.0.0`
	`1802`	`+changes:`
	`1803`	`+ - version: REPLACEME`
	`1804`	`+ pr-url: https://github.com/nodejs/node/pull/56201`
	`1805`	`+ description: Permission Model is now stable.`
	`1806`	`+-->`
	`1807`	`+`
	`1808`	`+> Stability: 2 - Stable.`
	`1809`	`+`
	`1810`	`+Enable the Permission Model for current process. When enabled, the`
	`1811`	`+following permissions are restricted:`
	`1812`	`+`
	`1813`	`+* File System - manageable through`
	`1814`	+ [`--allow-fs-read`][], [`--allow-fs-write`][] flags
	`1815`	+* Child Process - manageable through [`--allow-child-process`][] flag
	`1816`	+* Worker Threads - manageable through [`--allow-worker`][] flag
	`1817`	+* WASI - manageable through [`--allow-wasi`][] flag
	`1818`	+* Addons - manageable through [`--allow-addons`][] flag
	`1819`	`+`
`1810`	`1820`	### `--preserve-symlinks`
`1811`	`1821`
`1812`	`1822`	`<!-- YAML`
`@@ -3145,6 +3155,7 @@ one is included in the list below.`
`3145`	`3155`	* `--openssl-legacy-provider`
`3146`	`3156`	* `--openssl-shared-config`
`3147`	`3157`	* `--pending-deprecation`
	`3158`	+* `--permission`
`3148`	`3159`	* `--preserve-symlinks-main`
`3149`	`3160`	* `--preserve-symlinks`
`3150`	`3161`	* `--prof-process`

Collapse file

`‎doc/api/permissions.md‎`

Copy file name to clipboardExpand all lines: doc/api/permissions.md

+8-10Lines changed: 8 additions & 10 deletions

Display the source diff
Display the rich diff

Original file line number	Diff line number	Diff line change
`@@ -28,25 +28,25 @@ If you find a potential security vulnerability, please refer to our`
`28`	`28`
`29`	`29`	`<!-- type=misc -->`
`30`	`30`
`31`		`-> Stability: 1.1 - Active development`
	`31`	`+> Stability: 2 - Stable.`
`32`	`32`
`33`	`33`	`<!-- name=permission-model -->`
`34`	`34`
`35`	`35`	`The Node.js Permission Model is a mechanism for restricting access to specific`
`36`	`36`	`resources during execution.`
`37`		-The API exists behind a flag [`--experimental-permission`][] which when enabled,
	`37`	+The API exists behind a flag [`--permission`][] which when enabled,
`38`	`38`	`will restrict access to all available permissions.`
`39`	`39`
`40`		-The available permissions are documented by the [`--experimental-permission`][]
	`40`	+The available permissions are documented by the [`--permission`][]
`41`	`41`	`flag.`
`42`	`42`
`43`		-When starting Node.js with `--experimental-permission`,
	`43`	+When starting Node.js with `--permission`,
`44`	`44`	the ability to access the file system through the `fs` module, spawn processes,
`45`	`45`	use `node:worker_threads`, use native addons, use WASI, and enable the runtime inspector
`46`	`46`	`will be restricted.`
`47`	`47`
`48`	`48`	```console
`49`		`-$ node --experimental-permission index.js`
	`49`	`+$ node --permission index.js`
`50`	`50`
`51`	`51`	`Error: Access to this API has been restricted`
`52`	`52`	`at node:internal/main/run_main_module:23:47 {`
@@ -64,7 +64,7 @@ flag. For WASI, use the [`--allow-wasi`][] flag.
`64`	`64`
`65`	`65`	`#### Runtime API`
`66`	`66`
`67`		-When enabling the Permission Model through the [`--experimental-permission`][]
	`67`	+When enabling the Permission Model through the [`--permission`][]
`68`	`68`	flag a new property `permission` is added to the `process` object.
`69`	`69`	`This property contains one function:`
`70`	`70`
@@ -90,10 +90,8 @@ To allow access to the file system, use the [`--allow-fs-read`][] and
`90`	`90`	[`--allow-fs-write`][] flags:
`91`	`91`
`92`	`92`	```console
`93`		`-$ node --experimental-permission --allow-fs-read=* --allow-fs-write=* index.js`
	`93`	`+$ node --permission --allow-fs-read=* --allow-fs-write=* index.js`
`94`	`94`	`Hello world!`
`95`		`-(node:19836) ExperimentalWarning: Permission is an experimental feature`
`96`		-(Use `node --trace-warnings ...` to show where the warning was created)
`97`	`95`	```
`98`	`96`
`99`	`97`	`The valid arguments for both flags are:`
`@@ -167,5 +165,5 @@ There are constraints you need to know before using this system:`
`167`	`165`	[`--allow-fs-write`]: cli.md#--allow-fs-write
`168`	`166`	[`--allow-wasi`]: cli.md#--allow-wasi
`169`	`167`	[`--allow-worker`]: cli.md#--allow-worker
`170`		-[`--experimental-permission`]: cli.md#--experimental-permission
	`168`	+[`--permission`]: cli.md#--permission
`171`	`169`	[`permission.has()`]: process.md#processpermissionhasscope-reference

Collapse file

`‎doc/api/process.md‎`

Copy file name to clipboardExpand all lines: doc/api/process.md

+2-2Lines changed: 2 additions & 2 deletions

Display the source diff
Display the rich diff

Original file line number	Diff line number	Diff line change
`@@ -3091,7 +3091,7 @@ added: v20.0.0`
`3091`	`3091`
`3092`	`3092`	`* {Object}`
`3093`	`3093`
`3094`		-This API is available through the [`--experimental-permission`][] flag.
	`3094`	+This API is available through the [`--permission`][] flag.
`3095`	`3095`
`3096`	`3096`	`process.permission` is an object whose methods are used to manage permissions
`3097`	`3097`	`for the current process. Additional documentation is available in the`
`@@ -4428,8 +4428,8 @@ cases:`
`4428`	`4428`	[`'exit'`]: #event-exit
`4429`	`4429`	[`'message'`]: child_process.md#event-message
`4430`	`4430`	[`'uncaughtException'`]: #event-uncaughtexception
`4431`		-[`--experimental-permission`]: cli.md#--experimental-permission
`4432`	`4431`	[`--no-deprecation`]: cli.md#--no-deprecation
	`4432`	+[`--permission`]: cli.md#--permission
`4433`	`4433`	[`--unhandled-rejections`]: cli.md#--unhandled-rejectionsmode
`4434`	`4434`	[`Buffer`]: buffer.md
`4435`	`4435`	[`ChildProcess.disconnect()`]: child_process.md#subprocessdisconnect

Collapse file

`‎doc/node.1‎`

Copy file name to clipboardExpand all lines: doc/node.1

+2-2Lines changed: 2 additions & 2 deletions

Original file line number	Diff line number	Diff line change
`@@ -176,8 +176,8 @@ Specify the`
`176`	`176`	`.Ar module`
`177`	`177`	`to use as a custom module loader.`
`178`	`178`	`.`
`179`		`-.It Fl -experimental-permission`
`180`		`-Enable the experimental permission model.`
	`179`	`+.It Fl -permission`
	`180`	`+Enable the permission model.`
`181`	`181`	`.`
`182`	`182`	`.It Fl -experimental-shadow-realm`
`183`	`183`	`Use this flag to enable ShadowRealm support.`

Collapse file

`‎lib/internal/process/permission.js‎`

Copy file name to clipboardExpand all lines: lib/internal/process/permission.js

+4-4Lines changed: 4 additions & 4 deletions

Original file line number	Diff line number	Diff line change
`@@ -9,16 +9,16 @@ const { validateString, validateBuffer } = require('internal/validators');`
`9`	`9`	`const { Buffer } = require('buffer');`
`10`	`10`	`const { isBuffer } = Buffer;`
`11`	`11`
`12`		`-let experimentalPermission;`
	`12`	`+let _permission;`
`13`	`13`
`14`	`14`	`module.exports = ObjectFreeze({`
`15`	`15`	`__proto__: null,`
`16`	`16`	`isEnabled() {`
`17`		`- if (experimentalPermission === undefined) {`
	`17`	`+ if (_permission === undefined) {`
`18`	`18`	`const { getOptionValue } = require('internal/options');`
`19`		`- experimentalPermission = getOptionValue('--experimental-permission');`
	`19`	`+ _permission = getOptionValue('--permission');`
`20`	`20`	`}`
`21`		`- return experimentalPermission;`
	`21`	`+ return _permission;`
`22`	`22`	`},`
`23`	`23`	`has(scope, reference) {`
`24`	`24`	`validateString(scope, 'scope');`

Collapse file

`‎lib/internal/process/pre_execution.js‎`

Copy file name to clipboardExpand all lines: lib/internal/process/pre_execution.js

+3-4Lines changed: 3 additions & 4 deletions

Original file line number	Diff line number	Diff line change
`@@ -610,14 +610,13 @@ function initializeClusterIPC() {`
`610`	`610`	`}`
`611`	`611`
`612`	`612`	`function initializePermission() {`
`613`		`- const experimentalPermission = getOptionValue('--experimental-permission');`
`614`		`- if (experimentalPermission) {`
	`613`	`+ const permission = getOptionValue('--permission');`
	`614`	`+ if (permission) {`
`615`	`615`	`process.binding = function binding(_module) {`
`616`	`616`	`throw new ERR_ACCESS_DENIED('process.binding');`
`617`	`617`	`};`
`618`	`618`	`// Guarantee path module isn't monkey-patched to bypass permission model`
`619`	`619`	`ObjectFreeze(require('path'));`
`620`		`- emitExperimentalWarning('Permission');`
`621`	`620`	`const { has } = require('internal/process/permission');`
`622`	`621`	`const warnFlags = [`
`623`	`622`	`'--allow-addons',`
`@@ -669,7 +668,7 @@ function initializePermission() {`
`669`	`668`	`ArrayPrototypeForEach(availablePermissionFlags, (flag) => {`
`670`	`669`	`const value = getOptionValue(flag);`
`671`	`670`	`if (value.length) {`
`672`		`- throw new ERR_MISSING_OPTION('--experimental-permission');`
	`671`	`+ throw new ERR_MISSING_OPTION('--permission');`
`673`	`672`	`}`
`674`	`673`	`});`
`675`	`674`	`}`

Collapse file

`‎src/env.cc‎`

Copy file name to clipboardExpand all lines: src/env.cc

+1-1Lines changed: 1 addition & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -931,7 +931,7 @@ Environment::Environment(IsolateData* isolate_data,`
`931`	`931`	`std::move(traced_value));`
`932`	`932`	`}`
`933`	`933`
`934`		`- if (options_->experimental_permission) {`
	`934`	`+ if (options_->permission) {`
`935`	`935`	`permission()->EnablePermissions();`
`936`	`936`	`// The process shouldn't be able to neither`
`937`	`937`	`// spawn/worker nor use addons or enable inspector`

0 commit comments

Comments

0 (0)

You are visitor 01402520 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.