GeezerVison is showing github.com — doc: add note on weakness of permission model · nodejs/node@69fb71f
File tree
Expand file treeCollapse file tree
Open diff view settings
Expand file treeCollapse file tree
Open diff view settings
Collapse file
Copy file name to clipboardExpand all lines: doc/api/permissions.md +9Lines changed: 9 additions & 0 deletions - Display the source diff
- Display the rich diff
| Original file line number | Diff line number | Diff line change |
|---|
@@ -15,6 +15,15 @@ be accessed by other modules. |
15 | 15 | The resource can be entirely allowed or denied, or actions related to it can |
16 | 16 | be controlled. For example, file system reads can be allowed while denying |
17 | 17 | writes. |
| 18 | + This feature does not protect against malicious code. According to the Node.js |
| 19 | + [Security Policy][], Node.js trusts any code it is asked to run. |
| 20 | + |
| 21 | +The permission model implements a "seat belt" approach, which prevents trusted |
| 22 | +code from unintentionally changing files or using resources that access has |
| 23 | +not explicitly been granted to. It does not provide security guarantees in the |
| 24 | +presence of malicious code. Malicious code can bypass the permission model and |
| 25 | +execute arbitrary code without the restrictions imposed by the permission |
| 26 | +model. |
18 | 27 |
|
19 | 28 | If you find a potential security vulnerability, please refer to our |
20 | 29 | [Security Policy][]. |
|