GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — permission: fix chmod,chown,link, and lutimes by RafaelGSS · Pull Request #47529 · nodejs/node

Conversation

@RafaelGSS

@RafaelGSS RafaelGSS commented Apr 12, 2023 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Member

fs.chmod, fs.chown, fs.link , and fs.lutimes wasn't handled properly by the permission model. This PR fixes it and increase the coverage of all file system API using permission model
cc: @nodejs/security-wg

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
bricss and marco-ippolito reacted with thumbs up emoji
All reactions
  • 👍 2 reactions
@RafaelGSS
permission: fix chmod,chown improve fs coverage
3e537cd 
Signed-off-by: RafaelGSS <[email protected]>
@nodejs-github-bot nodejs-github-bot added c++ Issues and PRs that require attention from people who are familiar with C++. fs Issues and PRs related to file-system APIs and the fs module. needs-ci PRs that need a full CI run. labels Apr 12, 2023
@RafaelGSS RafaelGSS added the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label Apr 12, 2023
benjamingr
benjamingr approved these changes Apr 12, 2023
View reviewed changes
@github-actions github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label Apr 12, 2023
@nodejs-github-bot

nodejs-github-bot commented Apr 12, 2023

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/51169/
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
marco-ippolito
marco-ippolito approved these changes Apr 12, 2023
View reviewed changes

@marco-ippolito marco-ippolito left a comment

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@github-actions github-actions Bot mentioned this pull request Apr 13, 2023
CI Reliability 2023-04-13 nodejs/reliability#542
Open
36 tasks
@nodejs-github-bot

nodejs-github-bot commented Apr 13, 2023

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/51180/
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@nodejs-github-bot

nodejs-github-bot commented Apr 13, 2023

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/51199/
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@RafaelGSS RafaelGSS added the fast-track PRs proposed for a shorter-than-standard waiting period before landing. label Apr 13, 2023
@github-actions

github-actions Bot commented Apr 13, 2023

Copy link
Copy Markdown
Contributor

Fast-track has been requested by @RafaelGSS. Please 👍 to approve.
RafaelGSS, marco-ippolito, and BethGriggs reacted with thumbs up emoji
All reactions
  • 👍 3 reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@RafaelGSS

RafaelGSS commented Apr 13, 2023

Copy link
Copy Markdown
Member Author

I need to include it on v20.0.0 proposal for security reasons.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
tniessen
tniessen reviewed Apr 13, 2023
View reviewed changes

@tniessen tniessen left a comment

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The title and description only mention chmod and chown, but based on the diff, it looks like there are also issues with link and lutimes.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@tniessen tniessen added the security Issues and PRs related to security. label Apr 13, 2023
@RafaelGSS RafaelGSS changed the title permission: fix chmod,chown improve fs coverage permission: fix chmod,chown,link, and lutimes Apr 13, 2023
@tniessen

tniessen commented Apr 13, 2023

Copy link
Copy Markdown
Member

I need to include it on v20.0.0 proposal for security reasons.

We've previously delayed releasing the permission model whenever a new vulnerability was found. #44004 (comment) suggested a "a baking-time of 1 release for this feature (after landing all the patches)". It's not semver-major so we could land it in 20.1.0 instead, but I assume that's not really an option because 20.x is picking up everything from the main branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@RafaelGSS

RafaelGSS commented Apr 13, 2023

Copy link
Copy Markdown
Member Author

I need to include it on v20.0.0 proposal for security reasons.

We've previously delayed releasing the permission model whenever a new vulnerability was found. #44004 (comment) suggested a "a baking-time of 1 release for this feature (after landing all the patches)". It's not semver-major so we could land it in 20.1.0 instead, but I assume that's not really an option because 20.x is picking up everything from the main branch.

To not land it on v20.x we would need a revert PR to all affected PRs, which I'm not considering as an option for now.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@RafaelGSS RafaelGSS added the commit-queue PRs queued for automated landing through the Commit Queue. label Apr 13, 2023
@nodejs-github-bot nodejs-github-bot removed the commit-queue PRs queued for automated landing through the Commit Queue. label Apr 13, 2023
@nodejs-github-bot
nodejs-github-bot merged commit 1323992 into nodejs:main Apr 13, 2023
@nodejs-github-bot

nodejs-github-bot commented Apr 13, 2023

Copy link
Copy Markdown
Collaborator

Landed in 1323992
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@RafaelGSS RafaelGSS mentioned this pull request Apr 13, 2023
2023-04-18, Version 20.0.0 (Current) #47381
Merged
RafaelGSS added a commit that referenced this pull request Apr 13, 2023
@RafaelGSS
permission: fix chmod,chown improve fs coverage
8bcf0a4 
Signed-off-by: RafaelGSS <[email protected]>
PR-URL: #47529
Reviewed-By: Benjamin Gruenbaum <[email protected]>
Reviewed-By: Marco Ippolito <[email protected]>
@github-actions github-actions Bot mentioned this pull request Apr 15, 2023
CI Reliability 2023-04-15 nodejs/reliability#543
Open
33 tasks
@danielleadams danielleadams added the backport-requested-v18.x label Jul 3, 2023
@tniessen tniessen added the permission Issues and PRs related to the Permission Model. label Aug 10, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@tniessen tniessen tniessen left review comments
@benjamingr benjamingr benjamingr approved these changes
@marco-ippolito marco-ippolito marco-ippolito approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

c++ Issues and PRs that require attention from people who are familiar with C++. fast-track PRs proposed for a shorter-than-standard waiting period before landing. fs Issues and PRs related to file-system APIs and the fs module. needs-ci PRs that need a full CI run. permission Issues and PRs related to the Permission Model. security Issues and PRs related to security.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

6 participants

@RafaelGSS @nodejs-github-bot @tniessen @benjamingr @marco-ippolito @danielleadams
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.