fix: lock down allow-run permissions more (#25370)

`--allow-run` even with an allow list has essentially been
`--allow-all`... this locks it down more.

1. Resolves allow list for `--allow-run=` on startup to an absolute
path, then uses these paths when evaluating if a command can execute.
Also, adds these paths to `--deny-write`
1. Resolves the environment (cwd and env vars) before evaluating
permissions and before executing a command. Then uses this environment
to evaluate the permissions and then evaluate the command.

1 files changed, 18 insertions, 0 deletions

diff --git a/tests/specs/permission/path_not_permitted/main.ts b/tests/specs/permission/path_not_permitted/main.ts
new file mode 100644
index 000000000..9e8d627f2
--- /dev/null
+++ b/tests/specs/permission/path_not_permitted/main.ts
@@ -0,0 +1,18 @@
+const binaryName = Deno.build.os === "windows" ? "deno.exe" : "deno";
+Deno.copyFileSync(Deno.execPath(), binaryName);
+
+console.log("Running...");
+new Deno.Command(
+  Deno.execPath(),
+  {
+    args: [
+      "run",
+      "--allow-write",
+      "--allow-read",
+      `--allow-run=${binaryName}`,
+      "sub.ts",
+    ],
+    stderr: "inherit",
+    stdout: "inherit",
+  },
+).outputSync();