GeezerVison is showing github.com — src: simplify permissions with BooleanPermissions · nodejs/node@981cfa5
File treeExpand file treeCollapse file tree Open diff view settings Expand file treeCollapse file tree Open diff view settings Collapse file Copy file name to clipboardExpand all lines: node.gyp +2-16Lines changed: 2 additions & 16 deletions | Original file line number | Diff line number | Diff line change |
|---|
| 177 | 177 | 'src/node_worker.cc', | 178 | 178 | 'src/node_zlib.cc', | 179 | 179 | 'src/path.cc', | 180 | | - 'src/permission/child_process_permission.cc', | 181 | | - 'src/permission/openssl_store_permission.cc', | 182 | | - 'src/permission/ffi_permission.cc', | 183 | 180 | 'src/permission/fs_permission.cc', | 184 | | - 'src/permission/inspector_permission.cc', | 185 | 181 | 'src/permission/permission.cc', | 186 | | - 'src/permission/wasi_permission.cc', | 187 | | - 'src/permission/worker_permission.cc', | 188 | | - 'src/permission/net_permission.cc', | 189 | | - 'src/permission/addon_permission.cc', | 190 | 182 | 'src/pipe_wrap.cc', | 191 | 183 | 'src/process_wrap.cc', | 192 | 184 | 'src/signal_wrap.cc', | | 314 | 306 | 'src/node_watchdog.h', | 315 | 307 | 'src/node_worker.h', | 316 | 308 | 'src/path.h', | 317 | | - 'src/permission/child_process_permission.h', | 318 | | - 'src/permission/openssl_store_permission.h', | 319 | | - 'src/permission/ffi_permission.h', | | 309 | + 'src/permission/boolean_permission.h', | 320 | 310 | 'src/permission/fs_permission.h', | 321 | | - 'src/permission/inspector_permission.h', | 322 | 311 | 'src/permission/permission.h', | 323 | | - 'src/permission/wasi_permission.h', | 324 | | - 'src/permission/worker_permission.h', | 325 | | - 'src/permission/net_permission.h', | 326 | | - 'src/permission/addon_permission.h', | | 312 | + 'src/permission/permission_base.h', | 327 | 313 | 'src/pipe_wrap.h', | 328 | 314 | 'src/req_wrap.h', | 329 | 315 | 'src/req_wrap-inl.h', | |
Collapse file Copy file name to clipboardExpand all lines: src/permission/addon_permission.cc -30Lines changed: 0 additions & 30 deletions Collapse file Copy file name to clipboardExpand all lines: src/permission/addon_permission.h -34Lines changed: 0 additions & 34 deletions Collapse file Copy file name to clipboard +54Lines changed: 54 additions & 0 deletions | Original file line number | Diff line number | Diff line change |
|---|
| | 1 | +#ifndef SRC_PERMISSION_BOOLEAN_PERMISSION_H_ | | 2 | +#define SRC_PERMISSION_BOOLEAN_PERMISSION_H_ | | 3 | + | | 4 | +#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS | | 5 | + | | 6 | +#include "permission/permission_base.h" | | 7 | + | | 8 | +namespace node { | | 9 | + | | 10 | +namespace permission { | | 11 | + | | 12 | +// A simple boolean permission that either denies or allows access. | | 13 | +// Used for permission scopes that don't need per-resource granularity. | | 14 | +template <bool deny_only> | | 15 | +class BooleanPermission final : public PermissionBase { | | 16 | + public: | | 17 | + void Apply(Environment* env, | | 18 | + std::span<const std::string> allow, | | 19 | + PermissionScope scope) override { | | 20 | + flag_ = true; | | 21 | + } | | 22 | + | | 23 | + void Drop(Environment* env, | | 24 | + PermissionScope scope, | | 25 | + std::string_view param) override { | | 26 | + flag_ = deny_only; | | 27 | + } | | 28 | + | | 29 | + bool is_granted(Environment* env, | | 30 | + PermissionScope perm, | | 31 | + std::string_view param) const override { | | 32 | + if constexpr (deny_only) { | | 33 | + return !flag_; | | 34 | + } else { | | 35 | + return flag_; | | 36 | + } | | 37 | + } | | 38 | + | | 39 | + private: | | 40 | + bool flag_ = false; | | 41 | +}; | | 42 | + | | 43 | +// Once denied, the permission cannot be re-granted. | | 44 | +using DenyOnlyPermission = BooleanPermission<true>; | | 45 | + | | 46 | +// Apply grants access, Drop revokes. | | 47 | +using AllowRevokePermission = BooleanPermission<false>; | | 48 | + | | 49 | +} // namespace permission | | 50 | + | | 51 | +} // namespace node | | 52 | + | | 53 | +#endif // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS | | 54 | +#endif // SRC_PERMISSION_BOOLEAN_PERMISSION_H_ |
Collapse file Copy file name to clipboardExpand all lines: src/permission/child_process_permission.cc -30Lines changed: 0 additions & 30 deletions Collapse file Copy file name to clipboardExpand all lines: src/permission/child_process_permission.h -33Lines changed: 0 additions & 33 deletions Collapse file Copy file name to clipboardExpand all lines: src/permission/ffi_permission.cc -29Lines changed: 0 additions & 29 deletions Collapse file Copy file name to clipboardExpand all lines: src/permission/ffi_permission.h -33Lines changed: 0 additions & 33 deletions Collapse file Copy file name to clipboardExpand all lines: src/permission/fs_permission.h +5-3Lines changed: 5 additions & 3 deletions | Original file line number | Diff line number | Diff line change |
|---|
@@ -30,8 +30,7 @@ class FSPermission final : public PermissionBase { | 30 | 30 | Node* wildcard_child = nullptr; | 31 | 31 | bool is_leaf = false; | 32 | 32 |
| 33 | | - explicit Node(std::string_view pre) | 34 | | - : prefix(pre) {} | | 33 | + explicit Node(std::string_view pre) : prefix(pre) {} | 35 | 34 |
| 36 | 35 | Node() = default; | 37 | 36 |
| @@ -44,7 +43,10 @@ class FSPermission final : public PermissionBase { | 44 | 43 |
| 45 | 44 | void SetChild(char label, Node* node) { | 46 | 45 | for (auto& [c, n] : children) { | 47 | | - if (c == label) { n = node; return; } | | 46 | + if (c == label) { | | 47 | + n = node; | | 48 | + return; | | 49 | + } | 48 | 50 | } | 49 | 51 | children.emplace_back(label, node); | 50 | 52 | } | |
Collapse file Copy file name to clipboardExpand all lines: src/permission/inspector_permission.cc -30Lines changed: 0 additions & 30 deletions
|