Commit 62a46d9
committed
src,permission: restrict by default when pm enabled
PR-URL: #48907
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>1 parent e0fdb7b commit 62a46d9
2 files changed
Lines changed: 24 additions & 12 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -797,19 +797,17 @@ Environment::Environment(IsolateData* isolate_data, | |||
| 797 | 797 | ||
| 798 | 798 | if (options_->experimental_permission) { | |
| 799 | 799 | permission()->EnablePermissions(); | |
| 800 | - // If any permission is set the process shouldn't be able to neither | ||
| 800 | + // The process shouldn't be able to neither | ||
| 801 | 801 | // spawn/worker nor use addons or enable inspector | |
| 802 | 802 | // unless explicitly allowed by the user | |
| 803 | - if (!options_->allow_fs_read.empty() || !options_->allow_fs_write.empty()) { | ||
| 804 | - options_->allow_native_addons = false; | ||
| 805 | - flags_ = flags_ | EnvironmentFlags::kNoCreateInspector; | ||
| 806 | - permission()->Apply("*", permission::PermissionScope::kInspector); | ||
| 807 | - if (!options_->allow_child_process) { | ||
| 808 | - permission()->Apply("*", permission::PermissionScope::kChildProcess); | ||
| 809 | - } | ||
| 810 | - if (!options_->allow_worker_threads) { | ||
| 811 | - permission()->Apply("*", permission::PermissionScope::kWorkerThreads); | ||
| 812 | - } | ||
| 803 | + options_->allow_native_addons = false; | ||
| 804 | + flags_ = flags_ | EnvironmentFlags::kNoCreateInspector; | ||
| 805 | + permission()->Apply("*", permission::PermissionScope::kInspector); | ||
| 806 | + if (!options_->allow_child_process) { | ||
| 807 | + permission()->Apply("*", permission::PermissionScope::kChildProcess); | ||
| 808 | + } | ||
| 809 | + if (!options_->allow_worker_threads) { | ||
| 810 | + permission()->Apply("*", permission::PermissionScope::kWorkerThreads); | ||
| 813 | 811 | } | |
| 814 | 812 | ||
| 815 | 813 | if (!options_->allow_fs_read.empty()) { | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -1,4 +1,4 @@ | |||
| 1 | - // Flags: --experimental-permission --allow-fs-read=* | ||
| 1 | + // Flags: --experimental-permission --allow-fs-read=* --allow-child-process | ||
| 2 | 2 | 'use strict'; | |
| 3 | 3 | ||
| 4 | 4 | const common = require('../common'); | |
@@ -7,6 +7,7 @@ common.skipIfInspectorDisabled(); | |||
| 7 | 7 | ||
| 8 | 8 | const { Session } = require('inspector'); | |
| 9 | 9 | const assert = require('assert'); | |
| 10 | + const { spawnSync } = require('child_process'); | ||
| 10 | 11 | ||
| 11 | 12 | if (!common.hasCrypto) | |
| 12 | 13 | common.skip('no crypto'); | |
@@ -20,3 +21,16 @@ if (!common.hasCrypto) | |||
| 20 | 21 | permission: 'Inspector', | |
| 21 | 22 | })); | |
| 22 | 23 | } | |
| 24 | + | ||
| 25 | + { | ||
| 26 | + const { status, stderr } = spawnSync( | ||
| 27 | + process.execPath, | ||
| 28 | + [ | ||
| 29 | + '--experimental-permission', | ||
| 30 | + '-e', | ||
| 31 | + '(new (require("inspector")).Session()).connect()', | ||
| 32 | + ], | ||
| 33 | + ); | ||
| 34 | + assert.strictEqual(status, 1); | ||
| 35 | + assert.match(stderr.toString(), /Error: Access to this API has been restricted/); | ||
| 36 | + } | ||
0 commit comments