FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

src: add permission support to config file · nodejs/node@28c4f44 · GitHub

/ node Public

Commit 28c4f44

Browse files
marco-ippolito
authored
src: add permission support to config file
PR-URL: #60746 Backport-PR-URL: #62760 Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
1 parent 76d9c24 commit 28c4f44

12 files changed

Lines changed: 241 additions & 8 deletions

‎doc/api/permissions.md‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -151,6 +151,33 @@ does not exist, the wildcard will not be added, and access will be limited to
151151
yet, make sure to explicitly include the wildcard:
152152
`/my-path/folder-do-not-exist/*`.
153153

154+
#### Configuration file support
155+
156+
In addition to passing permission flags on the command line, they can also be
157+
declared in a Node.js configuration file when using the experimental
158+
\[`--experimental-config-file`]\[] flag. Permission options must be placed inside
159+
the `permission` top-level object.
160+
161+
Example `node.config.json`:
162+
163+
```json
164+
{
165+
"permission": {
166+
"allow-fs-read": ["./foo"],
167+
"allow-fs-write": ["./bar"],
168+
"allow-child-process": true,
169+
"allow-worker": true,
170+
"allow-addons": false
171+
}
172+
}
173+
```
174+
175+
Run with the configuration file:
176+
177+
```console
178+
$ node --permission --experimental-default-config-file app.js
179+
```
180+
154181
#### Using the Permission Model with `npx`
155182

156183
If you're using [`npx`][] to execute a Node.js script, you can enable the

‎doc/node-config-schema.json‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -603,6 +603,55 @@
603603
},
604604
"type": "object"
605605
},
606+
"permission": {
607+
"type": "object",
608+
"additionalProperties": false,
609+
"properties": {
610+
"allow-addons": {
611+
"type": "boolean"
612+
},
613+
"allow-child-process": {
614+
"type": "boolean"
615+
},
616+
"allow-fs-read": {
617+
"oneOf": [
618+
{
619+
"type": "string"
620+
},
621+
{
622+
"items": {
623+
"type": "string",
624+
"minItems": 1
625+
},
626+
"type": "array"
627+
}
628+
]
629+
},
630+
"allow-fs-write": {
631+
"oneOf": [
632+
{
633+
"type": "string"
634+
},
635+
{
636+
"items": {
637+
"type": "string",
638+
"minItems": 1
639+
},
640+
"type": "array"
641+
}
642+
]
643+
},
644+
"allow-inspector": {
645+
"type": "boolean"
646+
},
647+
"allow-wasi": {
648+
"type": "boolean"
649+
},
650+
"allow-worker": {
651+
"type": "boolean"
652+
}
653+
}
654+
},
606655
"testRunner": {
607656
"type": "object",
608657
"additionalProperties": false,

‎src/node_options.cc‎

Lines changed: 19 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -607,31 +607,43 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
607607
AddOption("--allow-fs-read",
608608
"allow permissions to read the filesystem",
609609
&EnvironmentOptions::allow_fs_read,
610-
kAllowedInEnvvar);
610+
kAllowedInEnvvar,
611+
OptionNamespaces::kPermissionNamespace);
611612
AddOption("--allow-fs-write",
612613
"allow permissions to write in the filesystem",
613614
&EnvironmentOptions::allow_fs_write,
614-
kAllowedInEnvvar);
615+
kAllowedInEnvvar,
616+
OptionNamespaces::kPermissionNamespace);
615617
AddOption("--allow-addons",
616618
"allow use of addons when any permissions are set",
617619
&EnvironmentOptions::allow_addons,
618-
kAllowedInEnvvar);
620+
kAllowedInEnvvar,
621+
false,
622+
OptionNamespaces::kPermissionNamespace);
619623
AddOption("--allow-child-process",
620624
"allow use of child process when any permissions are set",
621625
&EnvironmentOptions::allow_child_process,
622-
kAllowedInEnvvar);
626+
kAllowedInEnvvar,
627+
false,
628+
OptionNamespaces::kPermissionNamespace);
623629
AddOption("--allow-inspector",
624630
"allow use of inspector when any permissions are set",
625631
&EnvironmentOptions::allow_inspector,
626-
kAllowedInEnvvar);
632+
kAllowedInEnvvar,
633+
false,
634+
OptionNamespaces::kPermissionNamespace);
627635
AddOption("--allow-wasi",
628636
"allow wasi when any permissions are set",
629637
&EnvironmentOptions::allow_wasi,
630-
kAllowedInEnvvar);
638+
kAllowedInEnvvar,
639+
false,
640+
OptionNamespaces::kPermissionNamespace);
631641
AddOption("--allow-worker",
632642
"allow worker threads when any permissions are set",
633643
&EnvironmentOptions::allow_worker_threads,
634-
kAllowedInEnvvar);
644+
kAllowedInEnvvar,
645+
false,
646+
OptionNamespaces::kPermissionNamespace);
635647
AddOption("--experimental-repl-await",
636648
"experimental await keyword support in REPL",
637649
&EnvironmentOptions::experimental_repl_await,

‎src/node_options.h‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -415,7 +415,8 @@ std::vector<std::string> MapAvailableNamespaces();
415415
#define OPTION_NAMESPACE_LIST(V) \
416416
V(kNoNamespace, "") \
417417
V(kTestRunnerNamespace, "testRunner") \
418-
V(kWatchNamespace, "watch")
418+
V(kWatchNamespace, "watch") \
419+
V(kPermissionNamespace, "permission")
419420

420421
enum class OptionNamespaces {
421422
#define V(name, _) name,

‎test/fixtures/permission/child-process-test.js‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
const { spawnSync } = require('child_process');
2+
spawnSync(process.execPath, ['--version']);

‎test/fixtures/permission/config-addons-wasi.json‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
{
2+
"permission": {
3+
"allow-addons": true,
4+
"allow-wasi": true
5+
}
6+
}

‎test/fixtures/permission/config-child-worker.json‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
{
2+
"permission": {
3+
"allow-child-process": true,
4+
"allow-worker": true
5+
}
6+
}

‎test/fixtures/permission/config-fs-read-write.json‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
{
2+
"permission": {
3+
"allow-fs-read": [
4+
"*"
5+
],
6+
"allow-fs-write": [
7+
"*"
8+
]
9+
}
10+
}

‎test/fixtures/permission/config-net-inspector.json‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
{
2+
"permission": {
3+
"allow-wasi": true,
4+
"allow-inspector": true
5+
}
6+
}

‎test/fixtures/permission/fs-read-test.js‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
require('fs').readFileSync(__filename);

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL