8000 src,permission: add support to permission.has(addon) · nodejs/node@ed966a0 · GitHub
[go: up one dir, main page]
Skip to content

Commit ed966a0

Browse files
RafaelGSSRafaelGSS
committed
src,permission: add support to permission.has(addon)
PR-URL: #58951 Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com> Reviewed-By: Ilyas Shabi <ilyasshabi94@gmail.com>
1 parent e8dd189 commit ed966a0

File tree

9 files changed

+83
-1
lines changed

9 files changed

+83
-1
lines changed

‎node.gyp‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -163,6 +163,7 @@
163163
'src/permission/permission.cc',
164164
'src/permission/wasi_permission.cc',
165165
'src/permission/worker_permission.cc',
166+
'src/permission/addon_permission.cc',
166167
'src/pipe_wrap.cc',
167168
'src/process_wrap.cc',
168169
'src/signal_wrap.cc',
@@ -292,6 +293,7 @@
292293
'src/permission/permission.h',
293294
'src/permission/wasi_permission.h',
294295
'src/permission/worker_permission.h',
296+
'src/permission/addon_permission.h',
295297
'src/pipe_wrap.h',
296298
'src/req_wrap.h',
297299
'src/req_wrap-inl.h',

‎src/env.cc‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -913,6 +913,7 @@ Environment::Environment(IsolateData* isolate_data,
913913
// unless explicitly allowed by the user
914914
if (!options_->allow_addons) {
915915
options_->allow_native_addons = false;
916+
permission()->Apply(this, {"*"}, permission::PermissionScope::kAddon);
916917
}
917918
flags_ = flags_ | EnvironmentFlags::kNoCreateInspector;
918919
permission()->Apply(this, {"*"}, permission::PermissionScope::kInspector);

‎src/permission/addon_permission.cc‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
#include "addon_permission.h"
2+
3+
#include <string>
4+
5+
namespace node {
6+
7+
namespace permission {
8+
9+
// Currently, Addon manage a single state
10+
// Once denied, it's always denied
11+
void AddonPermission::Apply(Environment* env,
12+
const std::vector<std::string>& allow,
13+
PermissionScope scope) {
14+
deny_all_ = true;
15+
}
16+
17+
bool AddonPermission::is_granted(Environment* env,
18+
PermissionScope perm,
19+
const std::string_view& param) const {
20+
return deny_all_ == false;
21+
}
22+
23+
} // namespace permission
24+
} // namespace node

‎src/permission/addon_permission.h‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
#ifndef SRC_PERMISSION_ADDON_PERMISSION_H_
2+
#define SRC_PERMISSION_ADDON_PERMISSION_H_
3+
4+
#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
5+
6+
#include <string>
7+
#include "permission/permission_base.h"
8+
9+
namespace node {
10+
11+
namespace permission {
12+
13+
class AddonPermission final : public PermissionBase {
14+
public:
15+
void Apply(Environment* env,
16+
const std::vector<std::string>& allow,
17+
PermissionScope scope) override;
18+
bool is_granted(Environment* env,
19+
PermissionScope perm,
20+
const std::string_view& param = "") const override;
21+
22+
private:
23+
bool deny_all_;
24+
};
25+
26+
} // namespace permission
27+
28+
} // namespace node
29+
30+
#endif // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
31+
#endif // SRC_PERMISSION_ADDON_PERMISSION_H_

‎src/permission/permission.cc‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,7 @@ Permission::Permission() : enabled_(false) {
8484
std::shared_ptr<PermissionBase> inspector =
8585
std::make_shared<InspectorPermission>();
8686
std::shared_ptr<PermissionBase> wasi = std::make_shared<WASIPermission>();
87+
std::shared_ptr<PermissionBase> addon = std::make_shared<AddonPermission>();
8788
#define V(Name, _, __, ___) \
8889
nodes_.insert(std::make_pair(PermissionScope::k##Name, fs));
8990
FILESYSTEM_PERMISSIONS(V)
@@ -104,6 +105,10 @@ Permission::Permission() : enabled_(false) {
104105
nodes_.insert(std::make_pair(PermissionScope::k##Name, wasi));
105106
WASI_PERMISSIONS(V)
106107
#undef V
108+
#define V(Name, _, __, ___) \
109+
nodes_.insert(std::make_pair(PermissionScope::k##Name, addon));
110+
ADDON_PERMISSIONS(V)
111+
#undef V
107112
}
108113

109114
const char* GetErrorFlagSuggestion(node::permission::PermissionScope perm) {

‎src/permission/permission.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55

66
#include "debug_utils.h"
77
#include "node_options.h"
8+
#include "permission/addon_permission.h"
89
#include "permission/child_process_permission.h"
910
#include "permission/fs_permission.h"
1011
#include "permission/inspector_permission.h"

‎src/permission/permission_base.h‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,12 +29,16 @@ namespace permission {
2929

3030
#define INSPECTOR_PERMISSIONS(V) V(Inspector, "inspector", PermissionsRoot, "")
3131

32+
#define ADDON_PERMISSIONS(V) \
33+
V(Addon, "addon", PermissionsRoot, "--allow-addons")
34+
3235
#define PERMISSIONS(V) \
3336
FILESYSTEM_PERMISSIONS(V) \
3437
CHILD_PROCESS_PERMISSIONS(V) \
3538
WASI_PERMISSIONS(V) \
3639
WORKER_THREADS_PERMISSIONS(V) \
37-
INSPECTOR_PERMISSIONS(V)
40+
INSPECTOR_PERMISSIONS(V) \
41+
ADDON_PERMISSIONS(V)
3842

3943
#define V(name, _, __, ___) k##name,
4044
enum class PermissionScope {

‎test/parallel/test-permission-allow-addons-cli.js‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,3 +19,7 @@ const loadFixture = createRequire(fixtures.path('node_modules'));
1919
const msg = loadFixture('pkgexports/no-addons');
2020
assert.strictEqual(msg, 'using native addons');
2121
}
22+
23+
{
24+
assert.ok(process.permission.has('addon'));
25+
}

‎test/parallel/test-permission-has.js‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,3 +25,13 @@ const assert = require('assert');
2525
{
2626
assert.ok(!process.permission.has('FileSystemWrite', Buffer.from('reference')));
2727
}
28+
29+
{
30+
assert.ok(!process.permission.has('fs'));
31+
assert.ok(process.permission.has('fs.read'));
32+
assert.ok(!process.permission.has('fs.write'));
33+
assert.ok(!process.permission.has('wasi'));
34+
assert.ok(!process.permission.has('worker'));
35+
assert.ok(!process.permission.has('inspector'));
36+
assert.ok(!process.permission.has('addon'));
37+
}

0 commit comments

Comments
 (0)
0