Skip to content

src,permission: add multiple allow-fs-* flags - #49047

Merged
nodejs-github-bot merged 7 commits into
nodejs:mainfrom
Ceres6:permission-multiple-allows
Aug 17, 2023
Merged

src,permission: add multiple allow-fs-* flags#49047
nodejs-github-bot merged 7 commits into
nodejs:mainfrom
Ceres6:permission-multiple-allows

Conversation

@Ceres6

@Ceres6Ceres6 commented Aug 6, 2023•
edited
Loading

Copy link
Copy Markdown
Contributor

Breaking change: Support for a single comma separates list for allow-fs-* flags is removed.

This means that

--alow-fs-read=/path/to/file.txt,/other/file/path.txt

Will be interpreted as a single file.

When using a single flag and including commas in said flag a warning will be emitted explaining the change.

Instead now multiple flags can be passed to allow multiple paths.

--allow-fs-read=/path/to/file.txt --allow-fs-read=/other/file/path.txt

Will allow access to both paths.

Fixes: nodejs/security-wg#1039

@nodejs-github-bot

nodejs-github-bot commented Aug 6, 2023

Copy link
Copy Markdown
Collaborator

Review requested:

  • @nodejs/security-wg

@nodejs-github-botnodejs-github-bot added c++ Issues and PRs that require attention from people who are familiar with C++. lib / src Issues and PRs related to general changes in the lib or src directory. needs-ci PRs that need a full CI run. labels Aug 6, 2023
RafaelGSS
RafaelGSS reviewed Aug 10, 2023
View reviewed changes

@RafaelGSSRafaelGSS left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we have a test for the warning too?

Comment threaddoc/api/cli.md Outdated
Comment threadlib/internal/process/pre_execution.js Outdated
Comment threadlib/internal/process/pre_execution.js Outdated
Comment threadlib/internal/process/pre_execution.js Outdated
Comment threadlib/internal/process/pre_execution.js Outdated
Comment threadsrc/node_options.h Outdated
@tniessentniessen added the permission Issues and PRs related to the Permission Model label Aug 10, 2023
@Ceres6

Ceres6 commented Aug 10, 2023•
edited
Loading

Copy link
Copy Markdown
ContributorAuthor

Can we have a test for the warning too?

@RafaelGSS We do have one https://github.com/nodejs/node/pull/49047/files#diff-5928310ee410bbccf3599140510e07ca18546548955f67505349fa1fef2d6b48R83

richardlau
richardlau reviewed Aug 10, 2023
View reviewed changes

@richardlaurichardlau left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Possibly add changes metadata to the YAML blocks? e.g.

changes:
- version: REPLACEME
pr-url: https://github.com/nodejs/node/pull/49047
description: Paths delimited by comma (`,`) are no longer allowed.

Comment threaddoc/api/cli.md Outdated

@richardlaurichardlauAug 10, 2023•
edited
Loading

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This could also be added as changes metadata in the YAML block above.

Comment threaddoc/api/cli.md Outdated

@richardlaurichardlauAug 10, 2023•
edited
Loading

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This could also be added as changes metadata in the YAML block above.

@RafaelGSSRafaelGSS added the request-ci Add this label to start a Jenkins CI on a PR. label Aug 11, 2023
@github-actionsgithub-actionsBot removed the request-ci Add this label to start a Jenkins CI on a PR. label Aug 11, 2023
@nodejs-github-bot

nodejs-github-bot commented Aug 11, 2023

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/53186/

RafaelGSS
RafaelGSS reviewed Aug 11, 2023
View reviewed changes

@RafaelGSSRafaelGSS left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One import left

Comment threadsrc/permission/fs_permission.cc Outdated
@RafaelGSSRafaelGSS added the commit-queue-squash Add this label to instruct the Commit Queue to squash all the PR commits into the first one. label Aug 11, 2023
@Ceres6
Ceres6 requested a review from RafaelGSSAugust 11, 2023 16:34
@RafaelGSSRafaelGSS added the request-ci Add this label to start a Jenkins CI on a PR. label Aug 11, 2023
@github-actionsgithub-actionsBot removed the request-ci Add this label to start a Jenkins CI on a PR. label Aug 11, 2023
@nodejs-github-bot

nodejs-github-bot commented Aug 11, 2023

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/53210/

@RafaelGSS

RafaelGSS commented Aug 11, 2023

Copy link
Copy Markdown
Member

It seems the machines are broken. I'll wait a bit to request another CI.

@RafaelGSSRafaelGSS added the request-ci Add this label to start a Jenkins CI on a PR. label Aug 12, 2023
@github-actionsgithub-actionsBot removed the request-ci Add this label to start a Jenkins CI on a PR. label Aug 12, 2023
@nodejs-github-bot

This comment was marked as outdated.

Sign in to view
@RafaelGSSRafaelGSS added the request-ci Add this label to start a Jenkins CI on a PR. label Aug 12, 2023
@github-actionsgithub-actionsBot removed the request-ci Add this label to start a Jenkins CI on a PR. label Aug 12, 2023
@nodejs-github-bot

nodejs-github-bot commented Aug 12, 2023

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/53235/

Ceres6and others added 4 commits August 12, 2023 21:36
@Ceres6
src,permission: add multiple allow-fs-* flags
432f90a
Support for a single comma separates list for allow-fs-* flags is
removed. Instead now multiple flags can be passed to allow multiple
paths.
Fixes: nodejs/security-wg#1039
@Ceres6
fix tests
81ec076
@Ceres6@RafaelGSS
Update doc/api/cli.md
a75b87d
Co-authored-by: Rafael Gonzaga <rafael.nunu@hotmail.com>
@Ceres6@RafaelGSS
Update lib/internal/process/pre_execution.js
10d1288
Co-authored-by: Rafael Gonzaga <rafael.nunu@hotmail.com>
UlisesGascon added a commit that referenced this pull request Sep 13, 2023
@UlisesGascon
2023-09-18, Version 20.7.0 (Current)
d9e2456
Notable changes:
crypto:
* update root certificates to NSS 3.93 (Node.js GitHub Bot) #49341
doc:
* move and rename loaders section (Geoffrey Booth) #49261
* add release key for Ulises Gascon (Ulises Gascón) #49196
lib:
* (SEMVER-MINOR) add api to detect whether source-maps are enabled (翠 / green) #46391
src:
* support multiple `--env-file` declarations (Yagiz Nizipli) #49542
src,permission:
* add multiple allow-fs-* flags (Carlos Espa) #49047
test_runner:
* (SEMVER-MINOR) expose location of tests (Colin Ihrig) #48975
PR-URL: #49592
UlisesGascon added a commit that referenced this pull request Sep 16, 2023
@UlisesGascon
2023-09-18, Version 20.7.0 (Current)
3557c43
Notable changes:
crypto:
* update root certificates to NSS 3.93 (Node.js GitHub Bot) #49341
doc:
* move and rename loaders section (Geoffrey Booth) #49261
* add release key for Ulises Gascon (Ulises Gascón) #49196
lib:
* (SEMVER-MINOR) add api to detect whether source-maps are enabled (翠 / green) #46391
src:
* support multiple `--env-file` declarations (Yagiz Nizipli) #49542
src,permission:
* add multiple allow-fs-* flags (Carlos Espa) #49047
test_runner:
* (SEMVER-MINOR) expose location of tests (Colin Ihrig) #48975
PR-URL: #49592
UlisesGascon added a commit that referenced this pull request Sep 18, 2023
@UlisesGascon
2023-09-18, Version 20.7.0 (Current)
a71037e
Notable changes:
crypto:
* update root certificates to NSS 3.93 (Node.js GitHub Bot) #49341
deps:
* upgrade npm to 10.1.0 (npm team) #49570
* upgrade npm to 10.0.0 (npm team) #49423
doc:
* move and rename loaders section (Geoffrey Booth) #49261
* add release key for Ulises Gascon (Ulises Gascón) #49196
lib:
* (SEMVER-MINOR) add api to detect whether source-maps are enabled (翠 / green) #46391
src:
* support multiple `--env-file` declarations (Yagiz Nizipli) #49542
src,permission:
* add multiple allow-fs-* flags (Carlos Espa) #49047
test_runner:
* (SEMVER-MINOR) expose location of tests (Colin Ihrig) #48975
PR-URL: #49592
UlisesGascon added a commit to UlisesGascon/node that referenced this pull request Sep 18, 2023
@UlisesGascon
2023-09-18, Version 20.7.0 (Current)
b651e37
Notable changes:
crypto:
* update root certificates to NSS 3.93 (Node.js GitHub Bot) nodejs#49341
deps:
* upgrade npm to 10.1.0 (npm team) nodejs#49570
* upgrade npm to 10.0.0 (npm team) nodejs#49423
doc:
* move and rename loaders section (Geoffrey Booth) nodejs#49261
* add release key for Ulises Gascon (Ulises Gascón) nodejs#49196
lib:
* (SEMVER-MINOR) add api to detect whether source-maps are enabled (翠 / green) nodejs#46391
src:
* support multiple `--env-file` declarations (Yagiz Nizipli) nodejs#49542
src,permission:
* add multiple allow-fs-* flags (Carlos Espa) nodejs#49047
test_runner:
* (SEMVER-MINOR) expose location of tests (Colin Ihrig) nodejs#48975
PR-URL: nodejs#49592
@tniessentniessen mentioned this pull request Nov 10, 2023
Merged
tniessen added a commit to tniessen/node that referenced this pull request Nov 17, 2023
@tniessen
src: avoid copying strings in FSPermission::Apply
2ee82d5
The use of string_view and subsequent copying to a string was supposed
to be a minor optimization in 640a791, however, since 413c16e, no
string splitting occurs anymore. Therefore, we can simply pass around
some references instead of using string_view or copying strings.
Refs: nodejs#48491
Refs: nodejs#49047
nodejs-github-bot pushed a commit that referenced this pull request Nov 19, 2023
@tniessen
src: avoid copying strings in FSPermission::Apply
48f32d7
The use of string_view and subsequent copying to a string was supposed
to be a minor optimization in 640a791, however, since 413c16e, no
string splitting occurs anymore. Therefore, we can simply pass around
some references instead of using string_view or copying strings.
Refs: #48491
Refs: #49047
PR-URL: #50662
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
tniessen added a commit to tniessen/node that referenced this pull request Nov 21, 2023
@tniessen
doc: fix typos in --allow-fs-*
1d8d220
Refs: nodejs#49047
@tniessentniessen mentioned this pull request Nov 21, 2023
Merged
nodejs-github-bot pushed a commit that referenced this pull request Nov 22, 2023
@tniessen
doc: fix typos in --allow-fs-*
78beea7
Refs: #49047
PR-URL: #50845
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Vinícius Lourenço Claro Cardoso <contact@viniciusl.com.br>
Reviewed-By: Deokjin Kim <deokjin81.kim@gmail.com>
targos pushed a commit that referenced this pull request Nov 23, 2023
@tniessen@targos
src: avoid copying strings in FSPermission::Apply
e2862ab
The use of string_view and subsequent copying to a string was supposed
to be a minor optimization in 640a7918, however, since 413c16e, no
string splitting occurs anymore. Therefore, we can simply pass around
some references instead of using string_view or copying strings.
Refs: #48491
Refs: #49047
PR-URL: #50662
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
targos pushed a commit that referenced this pull request Nov 23, 2023
@tniessen@targos
doc: fix typos in --allow-fs-*
59541dc
Refs: #49047
PR-URL: #50845
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Vinícius Lourenço Claro Cardoso <contact@viniciusl.com.br>
Reviewed-By: Deokjin Kim <deokjin81.kim@gmail.com>
lucshi pushed a commit to lucshi/node that referenced this pull request Nov 27, 2023
@tniessenLei Shi
src: avoid copying strings in FSPermission::Apply
c801888
The use of string_view and subsequent copying to a string was supposed
to be a minor optimization in 640a791, however, since 413c16e, no
string splitting occurs anymore. Therefore, we can simply pass around
some references instead of using string_view or copying strings.
Refs: nodejs#48491
Refs: nodejs#49047
PR-URL: nodejs#50662
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
lucshi pushed a commit to lucshi/node that referenced this pull request Nov 27, 2023
@tniessenLei Shi
doc: fix typos in --allow-fs-*
802c11d
Refs: nodejs#49047
PR-URL: nodejs#50845
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Vinícius Lourenço Claro Cardoso <contact@viniciusl.com.br>
Reviewed-By: Deokjin Kim <deokjin81.kim@gmail.com>
RafaelGSS pushed a commit that referenced this pull request Nov 29, 2023
@tniessen@RafaelGSS
src: avoid copying strings in FSPermission::Apply
0fb35b6
The use of string_view and subsequent copying to a string was supposed
to be a minor optimization in 640a791, however, since 413c16e, no
string splitting occurs anymore. Therefore, we can simply pass around
some references instead of using string_view or copying strings.
Refs: #48491
Refs: #49047
PR-URL: #50662
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
RafaelGSS pushed a commit that referenced this pull request Nov 29, 2023
@tniessen@RafaelGSS
doc: fix typos in --allow-fs-*
a37d9ee
Refs: #49047
PR-URL: #50845
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Vinícius Lourenço Claro Cardoso <contact@viniciusl.com.br>
Reviewed-By: Deokjin Kim <deokjin81.kim@gmail.com>
UlisesGascon pushed a commit that referenced this pull request Dec 11, 2023
@tniessen@UlisesGascon
src: avoid copying strings in FSPermission::Apply
0e7acf9
The use of string_view and subsequent copying to a string was supposed
to be a minor optimization in 640a791, however, since 413c16e, no
string splitting occurs anymore. Therefore, we can simply pass around
some references instead of using string_view or copying strings.
Refs: #48491
Refs: #49047
PR-URL: #50662
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
UlisesGascon pushed a commit that referenced this pull request Dec 11, 2023
@tniessen@UlisesGascon
doc: fix typos in --allow-fs-*
408a12d
Refs: #49047
PR-URL: #50845
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Vinícius Lourenço Claro Cardoso <contact@viniciusl.com.br>
Reviewed-By: Deokjin Kim <deokjin81.kim@gmail.com>
UlisesGascon pushed a commit that referenced this pull request Dec 13, 2023
@tniessen@UlisesGascon
doc: fix typos in --allow-fs-*
ae78606
Refs: #49047
PR-URL: #50845
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Vinícius Lourenço Claro Cardoso <contact@viniciusl.com.br>
Reviewed-By: Deokjin Kim <deokjin81.kim@gmail.com>
UlisesGascon pushed a commit that referenced this pull request Dec 15, 2023
@tniessen@UlisesGascon
doc: fix typos in --allow-fs-*
d66cf00
Refs: #49047
PR-URL: #50845
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Vinícius Lourenço Claro Cardoso <contact@viniciusl.com.br>
Reviewed-By: Deokjin Kim <deokjin81.kim@gmail.com>
UlisesGascon pushed a commit that referenced this pull request Dec 19, 2023
@tniessen@UlisesGascon
src: avoid copying strings in FSPermission::Apply
d08eb38
The use of string_view and subsequent copying to a string was supposed
to be a minor optimization in 640a791, however, since 413c16e, no
string splitting occurs anymore. Therefore, we can simply pass around
some references instead of using string_view or copying strings.
Refs: #48491
Refs: #49047
PR-URL: #50662
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
UlisesGascon pushed a commit that referenced this pull request Dec 19, 2023
@tniessen@UlisesGascon
doc: fix typos in --allow-fs-*
e6e7cbc
Refs: #49047
PR-URL: #50845
Reviewed-By: Richard Lau <rlau@redhat.com>
Reviewed-By: Vinícius Lourenço Claro Cardoso <contact@viniciusl.com.br>
Reviewed-By: Deokjin Kim <deokjin81.kim@gmail.com>
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@RafaelGSSRafaelGSSRafaelGSS approved these changes
@marco-ippolitomarco-ippolitomarco-ippolito approved these changes
@richardlaurichardlauAwaiting requested review from richardlau

Assignees

No one assigned

Labels

c++Issues and PRs that require attention from people who are familiar with C++.commit-queue-squashAdd this label to instruct the Commit Queue to squash all the PR commits into the first one.lib / srcIssues and PRs related to general changes in the lib or src directory.needs-ciPRs that need a full CI run.notable-changePRs with changes that should be highlighted in changelogs.permissionIssues and PRs related to the Permission Model

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

How to includes "," or "*" char self in --allow-fs-read?

6 participants

@Ceres6@nodejs-github-bot@RafaelGSS@richardlau@marco-ippolito@tniessen