permission: enforce addon permission in GetLinkedBinding · nodejs/node@ac3c412 · GitHub

nodejs / node Public

• Notifications You must be signed in to change notification settings
• Fork 36.6k
• Star 120k

• Code
• Issues 636
• Pull requests 762
• Actions
• Projects
• Security and quality
• Insights

Additional navigation options

Commit ac3c412

Browse filesBrowse the repository at this point in the historyBrowse files

RafaelGSS

authored and

aduh95

committed

permission: enforce addon permission in GetLinkedBinding

Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com> PR-URL: #65432 Reviewed-By: Chengzhong Wu <legendecas@gmail.com> Reviewed-By: Beth Griggs <bethanyngriggs@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>

1 parent c2c31d6 commit ac3c412
Copy full SHA for ac3c412

3 files changed

+37Lines changed: 37 additions & 0 deletions

File tree

Expand file treeCollapse file tree

Open diff view settings

Filter options

• src
  • node_binding.cc
• test/parallel
  • test-permission-linked-binding-drop.js
  • test-permission-linked-binding.js

Expand file treeCollapse file tree

Open diff view settings

Collapse file

‎src/node_binding.cc‎

Copy file name to clipboardExpand all lines: src/node_binding.cc

+3Lines changed: 3 additions & 0 deletions

Original file line number	Diff line number	Diff line change
@@ -671,6 +671,9 @@ void GetLinkedBinding(const FunctionCallbackInfo<Value>& args) {
671	671
672	672	node::Utf8Value module_name_v(env->isolate(), module_name);
673	673	const char* name = *module_name_v;
	674	+ THROW_IF_INSUFFICIENT_PERMISSIONS(
	675	+ env, permission::PermissionScope::kAddon, module_name_v.ToStringView());
	676	+
674	677	node_module* mod = nullptr;
675	678
676	679	// Iterate from here to the nearest non-Worker Environment to see if there's

Collapse file

‎test/parallel/test-permission-linked-binding-drop.js‎

Copy file name to clipboard

+19Lines changed: 19 additions & 0 deletions

Original file line number	Diff line number	Diff line change
@@ -0,0 +1,19 @@
	1	+ // Flags: --permission --allow-addons --allow-fs-read=*
	2	+ 'use strict';
	3	+
	4	+ const common = require('../common');
	5	+ const assert = require('node:assert');
	6	+
	7	+ assert.strictEqual(process.permission.has('addon'), true);
	8	+
	9	+ process.permission.drop('addon');
	10	+
	11	+ assert.strictEqual(process.permission.has('addon'), false);
	12	+
	13	+ assert.throws(() => {
	14	+ process._linkedBinding('missing');
	15	+ }, common.expectsError({
	16	+ code: 'ERR_ACCESS_DENIED',
	17	+ permission: 'Addon',
	18	+ resource: 'missing',
	19	+ }));

Collapse file

‎test/parallel/test-permission-linked-binding.js‎

Copy file name to clipboard

+15Lines changed: 15 additions & 0 deletions

Original file line number	Diff line number	Diff line change
@@ -0,0 +1,15 @@
	1	+ // Flags: --permission --allow-fs-read=*
	2	+ 'use strict';
	3	+
	4	+ const common = require('../common');
	5	+ const assert = require('node:assert');
	6	+
	7	+ assert.strictEqual(process.permission.has('addon'), false);
	8	+
	9	+ assert.throws(() => {
	10	+ process._linkedBinding('missing');
	11	+ }, common.expectsError({
	12	+ code: 'ERR_ACCESS_DENIED',
	13	+ permission: 'Addon',
	14	+ resource: 'missing',
	15	+ }));

0 commit comments

Comments

0 (0)