GeezerVison is showing github.com — doc: add note on weakness of permission model · nodejs/node@8883c01
File tree
Expand file treeCollapse file tree
Open diff view settings
Expand file treeCollapse file tree
Open diff view settings
Collapse file
Copy file name to clipboardExpand all lines: doc/api/permissions.md +9Lines changed: 9 additions & 0 deletions - Display the source diff
- Display the rich diff
| Original file line number | Diff line number | Diff line change |
|---|
@@ -9,6 +9,15 @@ with those resources. |
9 | 9 | The resource can be entirely allowed or denied, or actions related to it can |
10 | 10 | be controlled. For example, file system reads can be allowed while denying |
11 | 11 | writes. |
| 12 | + This feature does not protect against malicious code. According to the Node.js |
| 13 | + [Security Policy][], Node.js trusts any code it is asked to run. |
| 14 | + |
| 15 | +The permission model implements a "seat belt" approach, which prevents trusted |
| 16 | +code from unintentionally changing files or using resources that access has |
| 17 | +not explicitly been granted to. It does not provide security guarantees in the |
| 18 | +presence of malicious code. Malicious code can bypass the permission model and |
| 19 | +execute arbitrary code without the restrictions imposed by the permission |
| 20 | +model. |
12 | 21 |
|
13 | 22 | If you find a potential security vulnerability, please refer to our |
14 | 23 | [Security Policy][]. |
|