| Age | Commit message (Collapse) | Author |
|---|
|
We only had integration tests for this and not an integration test.
Closes #26074
|
|
Although using `--allow-run` without an allow list gives basically no
security, I think we should remove this warning because it gets in the
way and the only way to disable it is via --quiet.
|
|
Using `--allow-all` with other `--allow-x` permission flags should cause
an error since `--allow-all` is a superset of `--allow-x`.
Closes #25901
|
|
|
|
This replaces `--allow-net` for import permissions and makes the
security sandbox stricter by also checking permissions for statically
analyzable imports.
By default, this has a value of
`--allow-import=deno.land:443,jsr.io:443,esm.sh:443,raw.githubusercontent.com:443,gist.githubusercontent.com:443`,
but that can be overridden by providing a different set of hosts.
Additionally, when no value is provided, import permissions are inferred
from the CLI arguments so the following works because
`fresh.deno.dev:443` will be added to the list of allowed imports:
```ts
deno run -A -r https://fresh.deno.dev
```
---------
Co-authored-by: David Sherret <dsherret@gmail.com>
|
|
Ref https://github.com/denoland/deno/pull/25215#discussion_r1762064605
|
|
|
|
This makes the permission system more versatile.
|
|
Closes #7394
---------
Co-authored-by: snek <snek@deno.com>
|
|
denied error (#25434)
Regression from https://github.com/denoland/deno/pull/25370
|
|
`--allow-run` even with an allow list has essentially been
`--allow-all`... this locks it down more.
1. Resolves allow list for `--allow-run=` on startup to an absolute
path, then uses these paths when evaluating if a command can execute.
Also, adds these paths to `--deny-write`
1. Resolves the environment (cwd and env vars) before evaluating
permissions and before executing a command. Then uses this environment
to evaluate the permissions and then evaluate the command.
|
|
`deno run script.ts <(some command)` is a valid use case -- let's allow
this to work without `--allow-all`.
Fixes #23703
|
|
Fixes [23721](https://github.com/denoland/deno/issues/23721)
|
|
This is not a special path that can be used to escalate or bypass Deno
permissions, such as `--allow-env`.
|
|
|
