Problem when using a library that uses `debug` in Deno

Open
#981 9 comments 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
45/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Stale
Tech stack
deno, javascript
Domain
tooling

Research direction

Start by inspecting src/node.js around line 124, where the issue's Deno stack trace shows environment access during module loading. Trace the module-load path and existing tests for Node-compatible environment handling. Done means importing debug in Deno no longer accesses process.env on module load or requires env permission.

Written by the indexing model from the issue text.

Description

I use jsdom in a project in Deno. jsdom uses debug as a dependency:

└─┬ jsdom@25.0.1
  ├─┬ http-proxy-agent@7.0.2
  │ ├─┬ agent-base@7.1.1
  │ │ └── debug@4.3.7 deduped
  │ └── debug@4.3.7
  └─┬ https-proxy-agent@7.0.5
    └── debug@4.3.7 deduped

Deno asks for permission for access to environment variables. Unfortunately debug accesses process.env directly and on requiring the module itself which leads to the following request by Deno.

┏ ⚠️  Deno requests env access.
┃  ├─ Object.toObject (ext:runtime/30_os.js:134:12)
┃  ├─ Object.ownKeys (ext:deno_node/_process/process.ts:54:40)
┃  ├─ Function.keys (<anonymous>)
┃  ├─ Object.<anonymous> (file:///home/krlwlfrt/work/krlwlfrt/calendar/node_modules/debug/src/node.js:124:30)
┃  ├─ Object.<anonymous> (file:///home/krlwlfrt/work/krlwlfrt/calendar/node_modules/debug/src/node.js:267:4)
┃  ├─ Module._compile (node:module:745:34)
┃  ├─ loadMaybeCjs (node:module:770:10)
┃  ├─ Object.Module._extensions..js (node:module:755:12)
┃  ├─ Module.load (node:module:662:32)
┃  └─ Function.Module._load (node:module:534:12)
┠─ Learn more at: https://docs.deno.com/go/--allow-env
┠─ Run again with --allow-env to bypass this prompt.
┗ Allow? [y/n/A] (y = yes, allow; n = no, deny; A = allow all env permissions) >

This goes against the principle of least privilege. Denying the request leads to an exception, because the code can't handle a rejection of that request with Deno's API.

Long story short: Could you please change the behaviour of your library, so that the process.env is not accessed on module load?

Dominant language
JavaScript
Stars
11.5k
Forks
992
No merged PRs in 30d

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from debug-js/debug

All issues in debug-js/debug

Similar issues

More JavaScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.