Permissions scripting

Ouverte
  • Quelque chose ne va pas ?
#67,130 0 commentaires 0 réactions 0 personnes assignées Voir sur GitHub

Les mainteneurs répondent en général sous 1 jour

Personne n'a encore pris cette issue.

Évaluation

Difficulté
5/5
Temps estimé
Plus d'une semaine
Accessibilité débutants
35/100
Type d'issue
Fonctionnalité
Clarté
Plutôt claire
Activité
Active
Stack technique
javascript, node.js
Domaine
security

Piste de recherche

The issue does not name implementation files or tests. Start by reading Node.js's existing permission model and tracing how permission checks handle filesystem, child-process, and network access. The proposal needs design decisions about the script API, how it interacts with existing flags, and how checks are enforced; done means those behaviors are specified and covered by tests.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

feature request
What is the problem this feature will solve?

Right now, permissions are either all-or-nothing, or each path must be manually specified.

There is also a lack of scoping on most permission flags. While adding scoping to these flags would help significantly, it would be helpful to be able to write custom logic to scope them in a more fine-grained fashion.

This feature request is primarily motivated by the lack of scoping on child. Initially I had drafted a feature request to add simple allow-listed scoping for child, but if, for instance, the python executable were to be allow-listed, a malicious script could run:

function portable_rm(file) {
  if (process.permission.has('fs.write', file) {
    // unlink file using node apis
  } else if (process.permission.has('child', 'rm') {
    // exec rm file
  } else if (process.permission.has('child', 'python') {
    // exec python -c 'import shutil; shutil.rmtree(...)'
  } // etc.
}

By using regex (or other custom logic), we can prevent these types of attacks by further limiting the command lines to known arguments.

What is the feature you are proposing to solve the problem?

A script that allows for custom scoping on all permission grants:

import path from 'node:path';

// Helper: path_str would already be an absolute path
function _check_path(path_str, allow_list) {
  for (const allowed_path of allow_list) {
    if (path.matchesGlob(path_str, path.resolve(allowed_path)))
      return true;
  }

  return false;
}

function check_fs_read(path_str) {
  return _check_path(path_str, [
    '/foo/*',
    './bar/baz.txt'
  ]);
}

function check_fs_write(path_str) {
  return _check_path(path_str, [
    './bar/baz.txt'
  ]);
}

function check_child(exec, args) {
  if (exec === "python") {
    if (args.length !== 2) return false;
    return args[0] === "myproc.py";
  } else if (exec === "esbuild") {
    if (args.length < 1) return false;
    return /^--(bundle|minify)$/.test(args[0]);
  }

  return false;
}

function check_net(addr) {
  return /^https:\/\/([^/]*\.)?mycompany\.com\//.test(addr);
}

export default {
  fs_read: check_fs_read,
  fs_write: check_fs_write,
  child: check_child,
  net: check_net,
  // any permission missing here would be denied by default, unless a respective --allow-* flag exists
}

It could then be run with (e.g.) node --permission --permissions-script=./permissions.js ...

The scoping does not necessarily have to be perfect, as just needs to match what the project knows it requires.

There would naturally be a minor performance hit, but this would allow for powerful scoping that would allow for projects to have permissions exactly as fine-grained as they needed.

On our end, the added security benefit far outweighs the performance hit, as it allows for better security during development. For deployment, we can replace the permission model with containers to remove the performance impact.

What alternatives have you considered?

  1. Using a socket-based permission broker: https://docs.deno.com/runtime/fundamentals/security/#permission-broker

  2. Adding regex-based allow-listing for child and net.

Langage dominant
JavaScript
Étoiles
123k
Forks
39.3k
Merge moyen
4 j 15 h
PR mergées (30 j)
238

Préparer son environnement

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de nodejs/node

Toutes les issues de nodejs/node

Issues similaires

Plus d'issues JavaScript

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.