Skip to content

src,permission: disable WASI when pm is enabled - #53124

Merged
nodejs-github-bot merged 2 commits into
nodejs:mainfrom
RafaelGSS:add-wasi-pm
Jun 1, 2024
Merged

src,permission: disable WASI when pm is enabled#53124
nodejs-github-bot merged 2 commits into
nodejs:mainfrom
RafaelGSS:add-wasi-pm

Conversation

@RafaelGSS

@RafaelGSSRafaelGSS commented May 23, 2024

Copy link
Copy Markdown
Member

Following up https://hackerone.com/reports/2470213.

The permission model currently does not cover WASI by default, and that's expected. But, it seems that I failed to document it properly (A (brief) documentation effort was made on #47782). I am creating a --allow-wasi flag to address this issue and potentially block WASI entirely.

@RafaelGSSRafaelGSS added semver-minor PRs that contain new features and should be released in the next minor version. permission Issues and PRs related to the Permission Model labels May 23, 2024
@nodejs-github-bot

nodejs-github-bot commented May 23, 2024

Copy link
Copy Markdown
Collaborator

Review requested:

  • @nodejs/gyp
  • @nodejs/security-wg
  • @nodejs/wasi

@nodejs-github-botnodejs-github-bot added c++ Issues and PRs that require attention from people who are familiar with C++. lib / src Issues and PRs related to general changes in the lib or src directory. needs-ci PRs that need a full CI run. labels May 23, 2024
@RafaelGSSRafaelGSS added the request-ci Add this label to start a Jenkins CI on a PR. label May 24, 2024
@github-actionsgithub-actionsBot removed the request-ci Add this label to start a Jenkins CI on a PR. label May 24, 2024
@nodejs-github-bot

nodejs-github-bot commented May 24, 2024

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/59393/

jasnell
jasnell reviewed May 25, 2024
View reviewed changes
Comment threaddoc/api/cli.md Outdated
@RafaelGSSRafaelGSS added the request-ci Add this label to start a Jenkins CI on a PR. label May 29, 2024
@github-actionsgithub-actionsBot removed the request-ci Add this label to start a Jenkins CI on a PR. label May 29, 2024
@nodejs-github-bot

nodejs-github-bot commented May 29, 2024

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/59528/

@avivkelleravivkeller mentioned this pull request May 30, 2024
Merged
@RafaelGSSRafaelGSS changed the title src,pm: disable WASI when pm is enabledsrc,permission: disable WASI when pm is enabledMay 30, 2024
@nodejs-github-bot

nodejs-github-bot commented May 30, 2024

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/59546/

@RafaelGSSRafaelGSS added the commit-queue Add this label to land a pull request using GitHub Actions. label Jun 1, 2024
@nodejs-github-botnodejs-github-bot removed the commit-queue Add this label to land a pull request using GitHub Actions. label Jun 1, 2024
@nodejs-github-bot
nodejs-github-bot merged commit 3ab0499 into nodejs:mainJun 1, 2024
@nodejs-github-bot

nodejs-github-bot commented Jun 1, 2024

Copy link
Copy Markdown
Collaborator

Landed in 3ab0499

@jakecastellijakecastelli mentioned this pull request Jun 2, 2024
Closed
targos pushed a commit that referenced this pull request Jun 3, 2024
@RafaelGSS@targos
src,permission: --allow-wasi & prevent WASI exec
75e5612
PR-URL: #53124
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
@RafaelGSSRafaelGSS mentioned this pull request Jun 7, 2024
Merged
RafaelGSS added a commit that referenced this pull request Jun 7, 2024
@RafaelGSS
2024-06-11, Version 22.3.0 (Current)
f52be7b
Notable changes:
buffer:
* (SEMVER-MINOR) add .bytes() method to Blob (Matthew Aitken) #53221
cli:
* (SEMVER-MINOR) add `NODE_RUN_PACKAGE_JSON_PATH` env (Yagiz Nizipli) #53058
* (SEMVER-MINOR) add `NODE_RUN_SCRIPT_NAME` env to `node --run` (Yagiz Nizipli) #53032
doc:
* (SEMVER-MINOR) add context.assert docs (Colin Ihrig) #53169
* (SEMVER-MINOR) improve explanation about built-in modules (Joyee Cheung) #52762
* add StefanStojanovic to collaborators (StefanStojanovic) #53118
* add Marco Ippolito to TSC (Rafael Gonzaga) #53008
fs:
* mark recursive cp methods as stable (Théo LUDWIG) #53127
lib:
* (SEMVER-MINOR) add EventSource Client (Aras Abbasi) #51575
* (SEMVER-MINOR) replace MessageEvent with undici's (Matthew Aitken) #52370
module:
* (SEMVER-MINOR) print amount of load time of a cjs module (Vinicius Lourenço) #52213
net:
* (SEMVER-MINOR) add new net.server.listen tracing channel (Paolo Insogna) #53136
process:
* (SEMVER-MINOR) add process.getBuiltinModule(id) (Joyee Cheung) #52762
src,permission:
* (SEMVER-MINOR) --allow-wasi & prevent WASI exec (Rafael Gonzaga) #53124
test_runner:
* (SEMVER-MINOR) add snapshot testing (Colin Ihrig) #53169
* (SEMVER-MINOR) add context.fullName (Colin Ihrig) #53169
* (SEMVER-MINOR) support module mocking (Colin Ihrig) #52848
PR-URL: #53379
RafaelGSS added a commit that referenced this pull request Jun 10, 2024
@RafaelGSS
2024-06-11, Version 22.3.0 (Current)
2e7a776
Notable changes:
buffer:
* (SEMVER-MINOR) add .bytes() method to Blob (Matthew Aitken) #53221
cli:
* (SEMVER-MINOR) add `NODE_RUN_PACKAGE_JSON_PATH` env (Yagiz Nizipli) #53058
* (SEMVER-MINOR) add `NODE_RUN_SCRIPT_NAME` env to `node --run` (Yagiz Nizipli) #53032
doc:
* (SEMVER-MINOR) add context.assert docs (Colin Ihrig) #53169
* (SEMVER-MINOR) improve explanation about built-in modules (Joyee Cheung) #52762
* add StefanStojanovic to collaborators (StefanStojanovic) #53118
* add Marco Ippolito to TSC (Rafael Gonzaga) #53008
fs:
* mark recursive cp methods as stable (Théo LUDWIG) #53127
lib:
* (SEMVER-MINOR) add EventSource Client (Aras Abbasi) #51575
* (SEMVER-MINOR) replace MessageEvent with undici's (Matthew Aitken) #52370
module:
* (SEMVER-MINOR) print amount of load time of a cjs module (Vinicius Lourenço) #52213
net:
* (SEMVER-MINOR) add new net.server.listen tracing channel (Paolo Insogna) #53136
process:
* (SEMVER-MINOR) add process.getBuiltinModule(id) (Joyee Cheung) #52762
src:
* (SEMVER-MINOR) traverse parent folders while running `--run` (Yagiz Nizipli) #53154
src,permission:
* (SEMVER-MINOR) --allow-wasi & prevent WASI exec (Rafael Gonzaga) #53124
test_runner:
* (SEMVER-MINOR) add snapshot testing (Colin Ihrig) #53169
* (SEMVER-MINOR) add context.fullName (Colin Ihrig) #53169
* (SEMVER-MINOR) support module mocking (Colin Ihrig) #52848
PR-URL: #53379
RafaelGSS added a commit that referenced this pull request Jun 11, 2024
@RafaelGSS
2024-06-11, Version 22.3.0 (Current)
d6c77de
Notable changes:
buffer:
* (SEMVER-MINOR) add .bytes() method to Blob (Matthew Aitken) #53221
cli:
* (SEMVER-MINOR) add `NODE_RUN_PACKAGE_JSON_PATH` env (Yagiz Nizipli) #53058
* (SEMVER-MINOR) add `NODE_RUN_SCRIPT_NAME` env to `node --run` (Yagiz Nizipli) #53032
doc:
* (SEMVER-MINOR) add context.assert docs (Colin Ihrig) #53169
* (SEMVER-MINOR) improve explanation about built-in modules (Joyee Cheung) #52762
* add StefanStojanovic to collaborators (StefanStojanovic) #53118
* add Marco Ippolito to TSC (Rafael Gonzaga) #53008
fs:
* mark recursive cp methods as stable (Théo LUDWIG) #53127
lib:
* (SEMVER-MINOR) add EventSource Client (Aras Abbasi) #51575
* (SEMVER-MINOR) replace MessageEvent with undici's (Matthew Aitken) #52370
module:
* (SEMVER-MINOR) print amount of load time of a cjs module (Vinicius Lourenço) #52213
net:
* (SEMVER-MINOR) add new net.server.listen tracing channel (Paolo Insogna) #53136
process:
* (SEMVER-MINOR) add process.getBuiltinModule(id) (Joyee Cheung) #52762
src:
* (SEMVER-MINOR) traverse parent folders while running `--run` (Yagiz Nizipli) #53154
src,permission:
* (SEMVER-MINOR) --allow-wasi & prevent WASI exec (Rafael Gonzaga) #53124
test_runner:
* (SEMVER-MINOR) add snapshot testing (Colin Ihrig) #53169
* (SEMVER-MINOR) add context.fullName (Colin Ihrig) #53169
* (SEMVER-MINOR) support module mocking (Colin Ihrig) #52848
PR-URL: #53379
soophoo pushed a commit to soophoo/node that referenced this pull request Jun 20, 2024
@RafaelGSS@soophoo
src,permission: --allow-wasi & prevent WASI exec
d40825b
PR-URL: nodejs#53124
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
soophoo pushed a commit to soophoo/node that referenced this pull request Jun 20, 2024
@RafaelGSS@soophoo
2024-06-11, Version 22.3.0 (Current)
ecded13
Notable changes:
buffer:
* (SEMVER-MINOR) add .bytes() method to Blob (Matthew Aitken) nodejs#53221
cli:
* (SEMVER-MINOR) add `NODE_RUN_PACKAGE_JSON_PATH` env (Yagiz Nizipli) nodejs#53058
* (SEMVER-MINOR) add `NODE_RUN_SCRIPT_NAME` env to `node --run` (Yagiz Nizipli) nodejs#53032
doc:
* (SEMVER-MINOR) add context.assert docs (Colin Ihrig) nodejs#53169
* (SEMVER-MINOR) improve explanation about built-in modules (Joyee Cheung) nodejs#52762
* add StefanStojanovic to collaborators (StefanStojanovic) nodejs#53118
* add Marco Ippolito to TSC (Rafael Gonzaga) nodejs#53008
fs:
* mark recursive cp methods as stable (Théo LUDWIG) nodejs#53127
lib:
* (SEMVER-MINOR) add EventSource Client (Aras Abbasi) nodejs#51575
* (SEMVER-MINOR) replace MessageEvent with undici's (Matthew Aitken) nodejs#52370
module:
* (SEMVER-MINOR) print amount of load time of a cjs module (Vinicius Lourenço) nodejs#52213
net:
* (SEMVER-MINOR) add new net.server.listen tracing channel (Paolo Insogna) nodejs#53136
process:
* (SEMVER-MINOR) add process.getBuiltinModule(id) (Joyee Cheung) nodejs#52762
src:
* (SEMVER-MINOR) traverse parent folders while running `--run` (Yagiz Nizipli) nodejs#53154
src,permission:
* (SEMVER-MINOR) --allow-wasi & prevent WASI exec (Rafael Gonzaga) nodejs#53124
test_runner:
* (SEMVER-MINOR) add snapshot testing (Colin Ihrig) nodejs#53169
* (SEMVER-MINOR) add context.fullName (Colin Ihrig) nodejs#53169
* (SEMVER-MINOR) support module mocking (Colin Ihrig) nodejs#52848
PR-URL: nodejs#53379
marco-ippolito pushed a commit that referenced this pull request Jul 19, 2024
@RafaelGSS@marco-ippolito
src,permission: --allow-wasi & prevent WASI exec
2bcce32
PR-URL: #53124
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
@marco-ippolitomarco-ippolito mentioned this pull request Jul 19, 2024
Merged
marco-ippolito added a commit that referenced this pull request Jul 19, 2024
@marco-ippolito
2024-07-24, Version 20.16.0 'Iron' (LTS)
7d0c53d
Notable changes:
buffer:
* (SEMVER-MINOR) add .bytes() method to Blob (Matthew Aitken) #53221
doc:
* doc-only deprecate OpenSSL engine-based APIs (Richard Lau) #53329
* (SEMVER-MINOR) add context.assert docs (Colin Ihrig) #53169
* (SEMVER-MINOR) improve explanation about built-in modules (Joyee Cheung) #52762
* add StefanStojanovic to collaborators (StefanStojanovic) #53118
* add Marco Ippolito to TSC (Rafael Gonzaga) #53008
inspector:
* fix disable async hooks on Debugger.setAsyncCallStackDepth (Joyee Cheung) #53473
net:
* (SEMVER-MINOR) add new net.server.listen tracing channel (Paolo Insogna) #53136
process:
* (SEMVER-MINOR) add process.getBuiltinModule(id) (Joyee Cheung) #52762
src,permission:
* (SEMVER-MINOR) --allow-wasi & prevent WASI exec (Rafael Gonzaga) #53124
test_runner:
* (SEMVER-MINOR) add context.fullName (Colin Ihrig) #53169
util:
* (SEMVER-MINOR) support `--no-` for argument with boolean type for parseArgs (Zhenwei Jin) #53107
PR-URL: #53945
marco-ippolito added a commit that referenced this pull request Jul 21, 2024
@marco-ippolito
2024-07-24, Version 20.16.0 'Iron' (LTS)
1968ef3
Notable changes:
buffer:
* (SEMVER-MINOR) add .bytes() method to Blob (Matthew Aitken) #53221
doc:
* doc-only deprecate OpenSSL engine-based APIs (Richard Lau) #53329
* (SEMVER-MINOR) add context.assert docs (Colin Ihrig) #53169
* (SEMVER-MINOR) improve explanation about built-in modules (Joyee Cheung) #52762
* add StefanStojanovic to collaborators (StefanStojanovic) #53118
* add Marco Ippolito to TSC (Rafael Gonzaga) #53008
inspector:
* fix disable async hooks on Debugger.setAsyncCallStackDepth (Joyee Cheung) #53473
net:
* (SEMVER-MINOR) add new net.server.listen tracing channel (Paolo Insogna) #53136
process:
* (SEMVER-MINOR) add process.getBuiltinModule(id) (Joyee Cheung) #52762
src,permission:
* (SEMVER-MINOR) --allow-wasi & prevent WASI exec (Rafael Gonzaga) #53124
test_runner:
* (SEMVER-MINOR) add context.fullName (Colin Ihrig) #53169
util:
* (SEMVER-MINOR) support `--no-` for argument with boolean type for parseArgs (Zhenwei Jin) #53107
PR-URL: #53945
marco-ippolito added a commit that referenced this pull request Jul 24, 2024
@marco-ippolito
2024-07-24, Version 20.16.0 'Iron' (LTS)
7a6185d
Notable changes:
buffer:
* (SEMVER-MINOR) add .bytes() method to Blob (Matthew Aitken) #53221
doc:
* doc-only deprecate OpenSSL engine-based APIs (Richard Lau) #53329
* (SEMVER-MINOR) add context.assert docs (Colin Ihrig) #53169
* (SEMVER-MINOR) improve explanation about built-in modules (Joyee Cheung) #52762
* add StefanStojanovic to collaborators (StefanStojanovic) #53118
* add Marco Ippolito to TSC (Rafael Gonzaga) #53008
inspector:
* fix disable async hooks on Debugger.setAsyncCallStackDepth (Joyee Cheung) #53473
net:
* (SEMVER-MINOR) add new net.server.listen tracing channel (Paolo Insogna) #53136
process:
* (SEMVER-MINOR) add process.getBuiltinModule(id) (Joyee Cheung) #52762
src,permission:
* (SEMVER-MINOR) --allow-wasi & prevent WASI exec (Rafael Gonzaga) #53124
test_runner:
* (SEMVER-MINOR) add context.fullName (Colin Ihrig) #53169
util:
* (SEMVER-MINOR) support `--no-` for argument with boolean type for parseArgs (Zhenwei Jin) #53107
PR-URL: #53945
codebytere added a commit to electron/electron that referenced this pull request Jul 25, 2024
@codebytere
src,permission: --allow-wasi & prevent WASI exec
6221285
nodejs/node#53124
codebytere added a commit to electron/electron that referenced this pull request Jul 26, 2024
@codebytere
src,permission: --allow-wasi & prevent WASI exec
72e793d
nodejs/node#53124
jkleinsc pushed a commit to electron/electron that referenced this pull request Jul 26, 2024
@electron-roller@codebytere@VerteDinde
chore: bump node to v20.16.0 (main) (#43029)
b3d52c0
* chore: bump node in DEPS to v20.16.0
* test: skip unstable shadow realm gc tests
nodejs/node#52855
* test: extend env for `test-node-output-errors`
nodejs/node#53535
* src: fix typo in env.cc
nodejs/node#53418
* src: reset `process.versions` during pre-execution
nodejs/node#53444
* chore: fixup patch indices
* src,permission: --allow-wasi & prevent WASI exec
nodejs/node#53124
* tls: use SSL_get_peer_tmp_key
nodejs/node#53366
* deps: update c-ares to 1.29.0
nodejs/node#53155
* src: account for OpenSSL unexpected version
* crypto: fix propagation of "memory limit exceeded"
nodejs/node#53300
* process: add process.getBuiltinModule(id)
nodejs/node#52762
* windows 32bit: config change callback needs to be stdcall
c-ares/c-ares@8f265c9
* fix: building with UNICODE
c-ares/c-ares#802
---------
Co-authored-by: electron-roller[bot] <84116207+electron-roller[bot]@users.noreply.github.com>
Co-authored-by: Shelley Vohr <shelley.vohr@gmail.com>
Co-authored-by: Keeley Hammond <khammond@slack-corp.com>
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jasnelljasnelljasnell left review comments
@aduh95aduh95aduh95 approved these changes
@marco-ippolitomarco-ippolitomarco-ippolito approved these changes

Assignees

No one assigned

Labels

c++Issues and PRs that require attention from people who are familiar with C++.lib / srcIssues and PRs related to general changes in the lib or src directory.needs-ciPRs that need a full CI run.permissionIssues and PRs related to the Permission Modelsemver-minorPRs that contain new features and should be released in the next minor version.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@RafaelGSS@nodejs-github-bot@jasnell@aduh95@marco-ippolito