From 5504acea6751480f1425c88353ad5d36257bdce7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bartek=20Iwa=C5=84czuk?= Date: Thu, 26 Sep 2024 02:50:54 +0100 Subject: feat: add `--allow-import` flag (#25469) This replaces `--allow-net` for import permissions and makes the security sandbox stricter by also checking permissions for statically analyzable imports. By default, this has a value of `--allow-import=deno.land:443,jsr.io:443,esm.sh:443,raw.githubusercontent.com:443,gist.githubusercontent.com:443`, but that can be overridden by providing a different set of hosts. Additionally, when no value is provided, import permissions are inferred from the CLI arguments so the following works because `fresh.deno.dev:443` will be added to the list of allowed imports: ```ts deno run -A -r https://fresh.deno.dev ``` --------- Co-authored-by: David Sherret --- tests/testdata/dynamic_import/permissions_blob_local.ts | 2 +- tests/testdata/dynamic_import/permissions_blob_remote.ts | 1 - tests/testdata/dynamic_import/permissions_blob_remote.ts.out | 4 ++-- tests/testdata/dynamic_import/permissions_data_local.ts | 2 +- tests/testdata/dynamic_import/permissions_data_remote.ts.out | 2 +- tests/testdata/dynamic_import/permissions_remote_remote.ts.out | 2 +- 6 files changed, 6 insertions(+), 7 deletions(-) (limited to 'tests/testdata/dynamic_import') diff --git a/tests/testdata/dynamic_import/permissions_blob_local.ts b/tests/testdata/dynamic_import/permissions_blob_local.ts index 9ef4158ce..865c1777a 100644 --- a/tests/testdata/dynamic_import/permissions_blob_local.ts +++ b/tests/testdata/dynamic_import/permissions_blob_local.ts @@ -1,4 +1,4 @@ -// This file doesn't really exist, but it doesn't matter, a "PermissionsDenied" error should be thrown. +// This file doesn't really exist, but it doesn't matter, a "NotCapable" error should be thrown. const code = `import "file:///${ Deno.build.os == "windows" ? "C:/" : "" }local_file.ts";`; diff --git a/tests/testdata/dynamic_import/permissions_blob_remote.ts b/tests/testdata/dynamic_import/permissions_blob_remote.ts index 1e2c8c21a..569b1f84c 100644 --- a/tests/testdata/dynamic_import/permissions_blob_remote.ts +++ b/tests/testdata/dynamic_import/permissions_blob_remote.ts @@ -1,4 +1,3 @@ -// This file doesn't really exist, but it doesn't matter, a "PermissionsDenied" error should be thrown. const code = `import "https://example.com/some/file.ts";`; const blob = new Blob([code]); await import(URL.createObjectURL(blob)); diff --git a/tests/testdata/dynamic_import/permissions_blob_remote.ts.out b/tests/testdata/dynamic_import/permissions_blob_remote.ts.out index f436a5eb8..20b6839e4 100644 --- a/tests/testdata/dynamic_import/permissions_blob_remote.ts.out +++ b/tests/testdata/dynamic_import/permissions_blob_remote.ts.out @@ -1,5 +1,5 @@ -error: Uncaught (in promise) TypeError: Requires net access to "example.com:443", run again with the --allow-net flag +error: Uncaught (in promise) TypeError: Requires import access to "example.com:443", run again with the --allow-import flag at blob:null/[WILDCARD]:1:8 await import(URL.createObjectURL(blob)); ^ - at async file:///[WILDCARD]/dynamic_import/permissions_blob_remote.ts:4:1 + at async file:///[WILDCARD]/dynamic_import/permissions_blob_remote.ts:3:1 diff --git a/tests/testdata/dynamic_import/permissions_data_local.ts b/tests/testdata/dynamic_import/permissions_data_local.ts index be4fc1c34..01bff7d7a 100644 --- a/tests/testdata/dynamic_import/permissions_data_local.ts +++ b/tests/testdata/dynamic_import/permissions_data_local.ts @@ -1,4 +1,4 @@ -// This file doesn't really exist, but it doesn't matter, a "PermissionsDenied" error should be thrown. +// This file doesn't really exist, but it doesn't matter, a "NotCapable" error should be thrown. const code = `import "file:///${ Deno.build.os == "windows" ? "C:/" : "" }local_file.ts";`; diff --git a/tests/testdata/dynamic_import/permissions_data_remote.ts.out b/tests/testdata/dynamic_import/permissions_data_remote.ts.out index 00248e277..67c851205 100644 --- a/tests/testdata/dynamic_import/permissions_data_remote.ts.out +++ b/tests/testdata/dynamic_import/permissions_data_remote.ts.out @@ -1,4 +1,4 @@ -error: Uncaught (in promise) TypeError: Requires net access to "example.com:443", run again with the --allow-net flag +error: Uncaught (in promise) TypeError: Requires import access to "example.com:443", run again with the --allow-import flag at data:application/javascript;base64,aW1wb3J0ICJodHRwczovL2V4YW1wbGUuY29tL3NvbWUvZmlsZS50cyI7:1:8 await import(`data:application/javascript;base64,${btoa(code)}`); ^ diff --git a/tests/testdata/dynamic_import/permissions_remote_remote.ts.out b/tests/testdata/dynamic_import/permissions_remote_remote.ts.out index 0e8b0fc1f..2676d7551 100644 --- a/tests/testdata/dynamic_import/permissions_remote_remote.ts.out +++ b/tests/testdata/dynamic_import/permissions_remote_remote.ts.out @@ -1,4 +1,4 @@ -error: Uncaught (in promise) TypeError: Requires net access to "example.com:443", run again with the --allow-net flag +error: Uncaught (in promise) TypeError: Requires import access to "example.com:443", run again with the --allow-import flag at http://localhost:4545/dynamic_import/static_remote.ts:2:8 await import( ^ -- cgit v1.2.3