FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

src,permission: add --allow-inspector ability · nodejs/node@29738c7 · GitHub

/ node Public

Commit 29738c7

Browse files
RafaelGSS
authored
src,permission: add --allow-inspector ability
Refs: #48534 PR-URL: #59711 Reviewed-By: Santiago Gimeno <santiago.gimeno@gmail.com> Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
1 parent ac131bd commit 29738c7

14 files changed

Lines changed: 112 additions & 5 deletions

‎doc/api/cli.md‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -275,6 +275,36 @@ When passing a single flag with a comma a warning will be displayed.
275275

276276
Examples can be found in the [File System Permissions][] documentation.
277277

278+
### `--allow-inspector`
279+
280+
<!-- YAML
281+
added: REPLACEME
282+
-->
283+
284+
> Stability: 1.0 - Early development
285+
286+
When using the [Permission Model][], the process will not be able to connect
287+
through inspector protocol.
288+
289+
Attempts to do so will throw an `ERR_ACCESS_DENIED` unless the
290+
user explicitly passes the `--allow-inspector` flag when starting Node.js.
291+
292+
Example:
293+
294+
```js
295+
const { Session } = require('node:inspector/promises');
296+
297+
const session = new Session();
298+
session.connect();
299+
```
300+
301+
```console
302+
$ node --permission index.js
303+
Error: connect ERR_ACCESS_DENIED Access to this API has been restricted. Use --allow-inspector to manage permissions.
304+
code: 'ERR_ACCESS_DENIED',
305+
}
306+
```
307+
278308
### `--allow-net`
279309

280310
<!-- YAML
@@ -3427,6 +3457,7 @@ one is included in the list below.
34273457
* `--allow-child-process`
34283458
* `--allow-fs-read`
34293459
* `--allow-fs-write`
3460+
* `--allow-inspector`
34303461
* `--allow-net`
34313462
* `--allow-wasi`
34323463
* `--allow-worker`

‎doc/api/permissions.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,8 @@ flag.
5151
When starting Node.js with `--permission`,
5252
the ability to access the file system through the `fs` module, access the network,
5353
spawn processes, use `node:worker_threads`, use native addons, use WASI, and
54-
enable the runtime inspector will be restricted.
54+
enable the runtime inspector will be restricted (the listener for SIGUSR1 won't
55+
be created).
5556

5657
```console
5758
$ node --permission index.js

‎doc/node-config-schema.json‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,9 @@
4545
}
4646
]
4747
},
48+
"allow-inspector": {
49+
"type": "boolean"
50+
},
4851
"allow-net": {
4952
"type": "boolean"
5053
},

‎doc/node.1‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -85,6 +85,9 @@ Allow using native addons when using the permission model.
8585
.It Fl -allow-child-process
8686
Allow spawning process when using the permission model.
8787
.
88+
.It Fl -allow-inspector
89+
Allow inspector access when using the permission model.
90+
.
8891
.It Fl -allow-net
8992
Allow network access when using the permission model.
9093
.

‎lib/internal/process/permission.js‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,7 @@ module.exports = ObjectFreeze({
4040
'--allow-addons',
4141
'--allow-child-process',
4242
'--allow-net',
43+
'--allow-inspector',
4344
'--allow-wasi',
4445
'--allow-worker',
4546
];

‎lib/internal/process/pre_execution.js‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -580,6 +580,7 @@ function initializePermission() {
580580
const warnFlags = [
581581
'--allow-addons',
582582
'--allow-child-process',
583+
'--allow-inspector',
583584
'--allow-wasi',
584585
'--allow-worker',
585586
];

‎src/env.cc‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -912,8 +912,10 @@ Environment::Environment(IsolateData* isolate_data,
912912
options_->allow_native_addons = false;
913913
permission()->Apply(this, {"*"}, permission::PermissionScope::kAddon);
914914
}
915-
flags_ = flags_ | EnvironmentFlags::kNoCreateInspector;
916-
permission()->Apply(this, {"*"}, permission::PermissionScope::kInspector);
915+
if (!options_->allow_inspector) {
916+
flags_ = flags_ | EnvironmentFlags::kNoCreateInspector;
917+
permission()->Apply(this, {"*"}, permission::PermissionScope::kInspector);
918+
}
917919
if (!options_->allow_child_process) {
918920
permission()->Apply(
919921
this, {"*"}, permission::PermissionScope::kChildProcess);

‎src/node_options.cc‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -606,6 +606,10 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
606606
"allow use of child process when any permissions are set",
607607
&EnvironmentOptions::allow_child_process,
608608
kAllowedInEnvvar);
609+
AddOption("--allow-inspector",
610+
"allow use of inspector when any permissions are set",
611+
&EnvironmentOptions::allow_inspector,
612+
kAllowedInEnvvar);
609613
AddOption("--allow-net",
610614
"allow use of network when any permissions are set",
611615
&EnvironmentOptions::allow_net,

‎src/node_options.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -141,6 +141,7 @@ class EnvironmentOptions : public Options {
141141
std::vector<std::string> allow_fs_read;
142142
std::vector<std::string> allow_fs_write;
143143
bool allow_addons = false;
144+
bool allow_inspector = false;
144145
bool allow_child_process = false;
145146
bool allow_net = false;
146147
bool allow_wasi = false;

‎src/permission/permission_base.h‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,8 @@ namespace permission {
2727
#define WORKER_THREADS_PERMISSIONS(V) \
2828
V(WorkerThreads, "worker", PermissionsRoot, "--allow-worker")
2929

30-
#define INSPECTOR_PERMISSIONS(V) V(Inspector, "inspector", PermissionsRoot, "")
30+
#define INSPECTOR_PERMISSIONS(V) \
31+
V(Inspector, "inspector", PermissionsRoot, "--allow-inspector")
3132

3233
#define NET_PERMISSIONS(V) V(Net, "net", PermissionsRoot, "--allow-net")
3334

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL