FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

src,permission: disable WASI when pm is enabled by RafaelGSS · Pull Request #53124 · nodejs/node · GitHub

/ node Public

src,permission: disable WASI when pm is enabled - #53124

Merged
nodejs-github-bot merged 2 commits into
nodejs:mainfrom
RafaelGSS:add-wasi-pm
Jun 1, 2024
Merged

src,permission: disable WASI when pm is enabled#53124
nodejs-github-bot merged 2 commits into
nodejs:mainfrom
RafaelGSS:add-wasi-pm

Conversation

Copy link
Copy Markdown
Member

Following up https://hackerone.com/reports/2470213.

The permission model currently does not cover WASI by default, and that's expected. But, it seems that I failed to document it properly (A (brief) documentation effort was made on #47782). I am creating a --allow-wasi flag to address this issue and potentially block WASI entirely.

RafaelGSS added semver-minor PRs that contain new features and should be released in the next minor version. permission Issues and PRs related to the Permission Model labels May 23, 2024

Copy link
Copy Markdown
Collaborator

Review requested:

  • @nodejs/gyp
  • @nodejs/security-wg
  • @nodejs/wasi

nodejs-github-bot added c++ Issues and PRs that require attention from people who are familiar with C++. lib / src Issues and PRs related to general changes in the lib or src directory. needs-ci PRs that need a full CI run. labels May 23, 2024
RafaelGSS added the request-ci Add this label to start a Jenkins CI on a PR. label May 24, 2024
github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. label May 24, 2024

Copy link
Copy Markdown
Collaborator

Comment thread doc/api/cli.md Outdated
RafaelGSS added the request-ci Add this label to start a Jenkins CI on a PR. label May 29, 2024
github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. label May 29, 2024

Copy link
Copy Markdown
Collaborator

RafaelGSS changed the title src,pm: disable WASI when pm is enabled src,permission: disable WASI when pm is enabled May 30, 2024

Copy link
Copy Markdown
Collaborator

RafaelGSS added the commit-queue Add this label to land a pull request using GitHub Actions. label Jun 1, 2024
nodejs-github-bot removed the commit-queue Add this label to land a pull request using GitHub Actions. label Jun 1, 2024
nodejs-github-bot merged commit 3ab0499 into nodejs:main Jun 1, 2024

Copy link
Copy Markdown
Collaborator

Landed in 3ab0499

targos pushed a commit that referenced this pull request Jun 3, 2024
PR-URL: #53124
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
RafaelGSS mentioned this pull request Jun 7, 2024
RafaelGSS added a commit that referenced this pull request Jun 7, 2024
Notable changes:

buffer:
  * (SEMVER-MINOR) add .bytes() method to Blob (Matthew Aitken) #53221
cli:
  * (SEMVER-MINOR) add `NODE_RUN_PACKAGE_JSON_PATH` env (Yagiz Nizipli) #53058
  * (SEMVER-MINOR) add `NODE_RUN_SCRIPT_NAME` env to `node --run` (Yagiz Nizipli) #53032
doc:
  * (SEMVER-MINOR) add context.assert docs (Colin Ihrig) #53169
  * (SEMVER-MINOR) improve explanation about built-in modules (Joyee Cheung) #52762
  * add StefanStojanovic to collaborators (StefanStojanovic) #53118
  * add Marco Ippolito to TSC (Rafael Gonzaga) #53008
fs:
  * mark recursive cp methods as stable (Théo LUDWIG) #53127
lib:
  * (SEMVER-MINOR) add EventSource Client (Aras Abbasi) #51575
  * (SEMVER-MINOR) replace MessageEvent with undici's (Matthew Aitken) #52370
module:
  * (SEMVER-MINOR) print amount of load time of a cjs module (Vinicius Lourenço) #52213
net:
  * (SEMVER-MINOR) add new net.server.listen tracing channel (Paolo Insogna) #53136
process:
  * (SEMVER-MINOR) add process.getBuiltinModule(id) (Joyee Cheung) #52762
src,permission:
  * (SEMVER-MINOR) --allow-wasi & prevent WASI exec (Rafael Gonzaga) #53124
test_runner:
  * (SEMVER-MINOR) add snapshot testing (Colin Ihrig) #53169
  * (SEMVER-MINOR) add context.fullName (Colin Ihrig) #53169
  * (SEMVER-MINOR) support module mocking (Colin Ihrig) #52848

PR-URL: #53379
RafaelGSS added a commit that referenced this pull request Jun 10, 2024
Notable changes:

buffer:
  * (SEMVER-MINOR) add .bytes() method to Blob (Matthew Aitken) #53221
cli:
  * (SEMVER-MINOR) add `NODE_RUN_PACKAGE_JSON_PATH` env (Yagiz Nizipli) #53058
  * (SEMVER-MINOR) add `NODE_RUN_SCRIPT_NAME` env to `node --run` (Yagiz Nizipli) #53032
doc:
  * (SEMVER-MINOR) add context.assert docs (Colin Ihrig) #53169
  * (SEMVER-MINOR) improve explanation about built-in modules (Joyee Cheung) #52762
  * add StefanStojanovic to collaborators (StefanStojanovic) #53118
  * add Marco Ippolito to TSC (Rafael Gonzaga) #53008
fs:
  * mark recursive cp methods as stable (Théo LUDWIG) #53127
lib:
  * (SEMVER-MINOR) add EventSource Client (Aras Abbasi) #51575
  * (SEMVER-MINOR) replace MessageEvent with undici's (Matthew Aitken) #52370
module:
  * (SEMVER-MINOR) print amount of load time of a cjs module (Vinicius Lourenço) #52213
net:
  * (SEMVER-MINOR) add new net.server.listen tracing channel (Paolo Insogna) #53136
process:
  * (SEMVER-MINOR) add process.getBuiltinModule(id) (Joyee Cheung) #52762
src:
  * (SEMVER-MINOR) traverse parent folders while running `--run` (Yagiz Nizipli) #53154
src,permission:
  * (SEMVER-MINOR) --allow-wasi & prevent WASI exec (Rafael Gonzaga) #53124
test_runner:
  * (SEMVER-MINOR) add snapshot testing (Colin Ihrig) #53169
  * (SEMVER-MINOR) add context.fullName (Colin Ihrig) #53169
  * (SEMVER-MINOR) support module mocking (Colin Ihrig) #52848

PR-URL: #53379
RafaelGSS added a commit that referenced this pull request Jun 11, 2024
Notable changes:

buffer:
  * (SEMVER-MINOR) add .bytes() method to Blob (Matthew Aitken) #53221
cli:
  * (SEMVER-MINOR) add `NODE_RUN_PACKAGE_JSON_PATH` env (Yagiz Nizipli) #53058
  * (SEMVER-MINOR) add `NODE_RUN_SCRIPT_NAME` env to `node --run` (Yagiz Nizipli) #53032
doc:
  * (SEMVER-MINOR) add context.assert docs (Colin Ihrig) #53169
  * (SEMVER-MINOR) improve explanation about built-in modules (Joyee Cheung) #52762
  * add StefanStojanovic to collaborators (StefanStojanovic) #53118
  * add Marco Ippolito to TSC (Rafael Gonzaga) #53008
fs:
  * mark recursive cp methods as stable (Théo LUDWIG) #53127
lib:
  * (SEMVER-MINOR) add EventSource Client (Aras Abbasi) #51575
  * (SEMVER-MINOR) replace MessageEvent with undici's (Matthew Aitken) #52370
module:
  * (SEMVER-MINOR) print amount of load time of a cjs module (Vinicius Lourenço) #52213
net:
  * (SEMVER-MINOR) add new net.server.listen tracing channel (Paolo Insogna) #53136
process:
  * (SEMVER-MINOR) add process.getBuiltinModule(id) (Joyee Cheung) #52762
src:
  * (SEMVER-MINOR) traverse parent folders while running `--run` (Yagiz Nizipli) #53154
src,permission:
  * (SEMVER-MINOR) --allow-wasi & prevent WASI exec (Rafael Gonzaga) #53124
test_runner:
  * (SEMVER-MINOR) add snapshot testing (Colin Ihrig) #53169
  * (SEMVER-MINOR) add context.fullName (Colin Ihrig) #53169
  * (SEMVER-MINOR) support module mocking (Colin Ihrig) #52848

PR-URL: #53379
soophoo pushed a commit to soophoo/node that referenced this pull request Jun 20, 2024
PR-URL: nodejs#53124
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
soophoo pushed a commit to soophoo/node that referenced this pull request Jun 20, 2024
Notable changes:

buffer:
  * (SEMVER-MINOR) add .bytes() method to Blob (Matthew Aitken) nodejs#53221
cli:
  * (SEMVER-MINOR) add `NODE_RUN_PACKAGE_JSON_PATH` env (Yagiz Nizipli) nodejs#53058
  * (SEMVER-MINOR) add `NODE_RUN_SCRIPT_NAME` env to `node --run` (Yagiz Nizipli) nodejs#53032
doc:
  * (SEMVER-MINOR) add context.assert docs (Colin Ihrig) nodejs#53169
  * (SEMVER-MINOR) improve explanation about built-in modules (Joyee Cheung) nodejs#52762
  * add StefanStojanovic to collaborators (StefanStojanovic) nodejs#53118
  * add Marco Ippolito to TSC (Rafael Gonzaga) nodejs#53008
fs:
  * mark recursive cp methods as stable (Théo LUDWIG) nodejs#53127
lib:
  * (SEMVER-MINOR) add EventSource Client (Aras Abbasi) nodejs#51575
  * (SEMVER-MINOR) replace MessageEvent with undici's (Matthew Aitken) nodejs#52370
module:
  * (SEMVER-MINOR) print amount of load time of a cjs module (Vinicius Lourenço) nodejs#52213
net:
  * (SEMVER-MINOR) add new net.server.listen tracing channel (Paolo Insogna) nodejs#53136
process:
  * (SEMVER-MINOR) add process.getBuiltinModule(id) (Joyee Cheung) nodejs#52762
src:
  * (SEMVER-MINOR) traverse parent folders while running `--run` (Yagiz Nizipli) nodejs#53154
src,permission:
  * (SEMVER-MINOR) --allow-wasi & prevent WASI exec (Rafael Gonzaga) nodejs#53124
test_runner:
  * (SEMVER-MINOR) add snapshot testing (Colin Ihrig) nodejs#53169
  * (SEMVER-MINOR) add context.fullName (Colin Ihrig) nodejs#53169
  * (SEMVER-MINOR) support module mocking (Colin Ihrig) nodejs#52848

PR-URL: nodejs#53379
marco-ippolito pushed a commit that referenced this pull request Jul 19, 2024
PR-URL: #53124
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
marco-ippolito added a commit that referenced this pull request Jul 19, 2024
Notable changes:

buffer:
  * (SEMVER-MINOR) add .bytes() method to Blob (Matthew Aitken) #53221
doc:
  * doc-only deprecate OpenSSL engine-based APIs (Richard Lau) #53329
  * (SEMVER-MINOR) add context.assert docs (Colin Ihrig) #53169
  * (SEMVER-MINOR) improve explanation about built-in modules (Joyee Cheung) #52762
  * add StefanStojanovic to collaborators (StefanStojanovic) #53118
  * add Marco Ippolito to TSC (Rafael Gonzaga) #53008
inspector:
  * fix disable async hooks on Debugger.setAsyncCallStackDepth (Joyee Cheung) #53473
net:
  * (SEMVER-MINOR) add new net.server.listen tracing channel (Paolo Insogna) #53136
process:
  * (SEMVER-MINOR) add process.getBuiltinModule(id) (Joyee Cheung) #52762
src,permission:
  * (SEMVER-MINOR) --allow-wasi & prevent WASI exec (Rafael Gonzaga) #53124
test_runner:
  * (SEMVER-MINOR) add context.fullName (Colin Ihrig) #53169
util:
  * (SEMVER-MINOR) support `--no-` for argument with boolean type for parseArgs (Zhenwei Jin) #53107

PR-URL: #53945
marco-ippolito added a commit that referenced this pull request Jul 21, 2024
Notable changes:

buffer:
  * (SEMVER-MINOR) add .bytes() method to Blob (Matthew Aitken) #53221
doc:
  * doc-only deprecate OpenSSL engine-based APIs (Richard Lau) #53329
  * (SEMVER-MINOR) add context.assert docs (Colin Ihrig) #53169
  * (SEMVER-MINOR) improve explanation about built-in modules (Joyee Cheung) #52762
  * add StefanStojanovic to collaborators (StefanStojanovic) #53118
  * add Marco Ippolito to TSC (Rafael Gonzaga) #53008
inspector:
  * fix disable async hooks on Debugger.setAsyncCallStackDepth (Joyee Cheung) #53473
net:
  * (SEMVER-MINOR) add new net.server.listen tracing channel (Paolo Insogna) #53136
process:
  * (SEMVER-MINOR) add process.getBuiltinModule(id) (Joyee Cheung) #52762
src,permission:
  * (SEMVER-MINOR) --allow-wasi & prevent WASI exec (Rafael Gonzaga) #53124
test_runner:
  * (SEMVER-MINOR) add context.fullName (Colin Ihrig) #53169
util:
  * (SEMVER-MINOR) support `--no-` for argument with boolean type for parseArgs (Zhenwei Jin) #53107

PR-URL: #53945
marco-ippolito added a commit that referenced this pull request Jul 24, 2024
Notable changes:

buffer:
  * (SEMVER-MINOR) add .bytes() method to Blob (Matthew Aitken) #53221
doc:
  * doc-only deprecate OpenSSL engine-based APIs (Richard Lau) #53329
  * (SEMVER-MINOR) add context.assert docs (Colin Ihrig) #53169
  * (SEMVER-MINOR) improve explanation about built-in modules (Joyee Cheung) #52762
  * add StefanStojanovic to collaborators (StefanStojanovic) #53118
  * add Marco Ippolito to TSC (Rafael Gonzaga) #53008
inspector:
  * fix disable async hooks on Debugger.setAsyncCallStackDepth (Joyee Cheung) #53473
net:
  * (SEMVER-MINOR) add new net.server.listen tracing channel (Paolo Insogna) #53136
process:
  * (SEMVER-MINOR) add process.getBuiltinModule(id) (Joyee Cheung) #52762
src,permission:
  * (SEMVER-MINOR) --allow-wasi & prevent WASI exec (Rafael Gonzaga) #53124
test_runner:
  * (SEMVER-MINOR) add context.fullName (Colin Ihrig) #53169
util:
  * (SEMVER-MINOR) support `--no-` for argument with boolean type for parseArgs (Zhenwei Jin) #53107

PR-URL: #53945
codebytere added a commit to electron/electron that referenced this pull request Jul 25, 2024
codebytere added a commit to electron/electron that referenced this pull request Jul 26, 2024
jkleinsc pushed a commit to electron/electron that referenced this pull request Jul 26, 2024
* chore: bump node in DEPS to v20.16.0

* test: skip unstable shadow realm gc tests

nodejs/node#52855

* test: extend env for `test-node-output-errors`

nodejs/node#53535

* src: fix typo in env.cc

nodejs/node#53418

* src: reset `process.versions` during pre-execution

nodejs/node#53444

* chore: fixup patch indices

* src,permission: --allow-wasi & prevent WASI exec

nodejs/node#53124

* tls: use SSL_get_peer_tmp_key

nodejs/node#53366

* deps: update c-ares to 1.29.0

nodejs/node#53155

* src: account for OpenSSL unexpected version

* crypto: fix propagation of "memory limit exceeded"

nodejs/node#53300

* process: add process.getBuiltinModule(id)

nodejs/node#52762

* windows 32bit: config change callback needs to be stdcall

c-ares/c-ares@8f265c9

* fix: building with UNICODE

c-ares/c-ares#802

---------

Co-authored-by: electron-roller[bot] <84116207+electron-roller[bot]@users.noreply.github.com>
Co-authored-by: Shelley Vohr <shelley.vohr@gmail.com>
Co-authored-by: Keeley Hammond <khammond@slack-corp.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

c++ Issues and PRs that require attention from people who are familiar with C++. lib / src Issues and PRs related to general changes in the lib or src directory. needs-ci PRs that need a full CI run. permission Issues and PRs related to the Permission Model semver-minor PRs that contain new features and should be released in the next minor version.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants


Back | FazBrowse Home | New Git URL