Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: remove --allow-run warning when using deno without args or subcommand #25684

Merged
merged 9 commits into from
Sep 18, 2024
Merged

fix: remove --allow-run warning when using deno without args or subcommand #25684

Changes from 3 commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
51c5a0b
fix: remove --allow-run warning when using deno without args or subco…
HasanAlrimawi Sep 17, 2024
fa04594
Merge branch 'main' into remove-unneeded-warning-on-deno-repl-no-args
HasanAlrimawi Sep 17, 2024
d232aa6
retrigger checks as test succeeds locally
HasanAlrimawi Sep 17, 2024
b79a723
set allow-all flag instead of checking repl_flags property
HasanAlrimawi Sep 18, 2024
3d6ccb4
Merge branch 'main' into remove-unneeded-warning-on-deno-repl-no-args
HasanAlrimawi Sep 18, 2024
20535bd
update tests connected to the change
HasanAlrimawi Sep 18, 2024
bf468b0
Update allow_all
dsherret Sep 18, 2024
3eecc8a
fix
dsherret Sep 18, 2024
4159035
fix
dsherret Sep 18, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 7 additions & 2 deletions cli/args/mod.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1702,8 +1702,13 @@ fn warn_insecure_allow_run_flags(flags: &Flags) {
return;
};

// discourage using --allow-run without an allow list
if allow_run_list.is_empty() {
let is_no_args_deno = match flags.subcommand.clone() {
DenoSubcommand::Repl(repl_flags) => repl_flags.is_default_command,
_ => false,
};
// discourage using --allow-run without an allow list, but
// allow it when no args deno is used [deno] without subcommand
if allow_run_list.is_empty() && !is_no_args_deno {
Copy link
Member

@dsherret dsherret Sep 17, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we should change this to instead set flags.permissions.allow_all = true;:

deno/cli/args/flags.rs

Lines 1370 to 1376 in f360cae

flags.permissions.allow_net = Some(vec![]);
flags.permissions.allow_env = Some(vec![]);
flags.permissions.allow_run = Some(vec![]);
flags.permissions.allow_read = Some(vec![]);
flags.permissions.allow_sys = Some(vec![]);
flags.permissions.allow_write = Some(vec![]);
flags.permissions.allow_ffi = Some(vec![]);

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There's actually a flags.allow_all(); and I think internally that should just set flags.permissions.allow_all = true only.

log::warn!(
"{} --allow-run can be trivially exploited. Prefer specifying an allow list (https://docs.deno.com/runtime/fundamentals/security/#running-subprocesses)",
colors::yellow("Warning")
Expand Down