Permissions scripting

Aberta
  • Algo errado?
#67,130 0 comentários 0 reações 0 responsáveis Ver no GitHub

Mantenedores costumam responder em até 1 dia

Ninguém assumiu esta issue ainda.

Avaliação

Dificuldade
5/5
Tempo estimado
Mais de uma semana
Facilidade para iniciantes
35/100
Tipo de issue
Funcionalidade
Clareza
Razoavelmente clara
Status de atividade
Ativa
Stack de tecnologia
javascript, node.js
Domínio
security

Direção de pesquisa

The issue does not name implementation files or tests. Start by reading Node.js's existing permission model and tracing how permission checks handle filesystem, child-process, and network access. The proposal needs design decisions about the script API, how it interacts with existing flags, and how checks are enforced; done means those behaviors are specified and covered by tests.

Escrita pelo modelo de indexação a partir do texto da issue.

Descrição

feature request
What is the problem this feature will solve?

Right now, permissions are either all-or-nothing, or each path must be manually specified.

There is also a lack of scoping on most permission flags. While adding scoping to these flags would help significantly, it would be helpful to be able to write custom logic to scope them in a more fine-grained fashion.

This feature request is primarily motivated by the lack of scoping on child. Initially I had drafted a feature request to add simple allow-listed scoping for child, but if, for instance, the python executable were to be allow-listed, a malicious script could run:

function portable_rm(file) {
  if (process.permission.has('fs.write', file) {
    // unlink file using node apis
  } else if (process.permission.has('child', 'rm') {
    // exec rm file
  } else if (process.permission.has('child', 'python') {
    // exec python -c 'import shutil; shutil.rmtree(...)'
  } // etc.
}

By using regex (or other custom logic), we can prevent these types of attacks by further limiting the command lines to known arguments.

What is the feature you are proposing to solve the problem?

A script that allows for custom scoping on all permission grants:

import path from 'node:path';

// Helper: path_str would already be an absolute path
function _check_path(path_str, allow_list) {
  for (const allowed_path of allow_list) {
    if (path.matchesGlob(path_str, path.resolve(allowed_path)))
      return true;
  }

  return false;
}

function check_fs_read(path_str) {
  return _check_path(path_str, [
    '/foo/*',
    './bar/baz.txt'
  ]);
}

function check_fs_write(path_str) {
  return _check_path(path_str, [
    './bar/baz.txt'
  ]);
}

function check_child(exec, args) {
  if (exec === "python") {
    if (args.length !== 2) return false;
    return args[0] === "myproc.py";
  } else if (exec === "esbuild") {
    if (args.length < 1) return false;
    return /^--(bundle|minify)$/.test(args[0]);
  }

  return false;
}

function check_net(addr) {
  return /^https:\/\/([^/]*\.)?mycompany\.com\//.test(addr);
}

export default {
  fs_read: check_fs_read,
  fs_write: check_fs_write,
  child: check_child,
  net: check_net,
  // any permission missing here would be denied by default, unless a respective --allow-* flag exists
}

It could then be run with (e.g.) node --permission --permissions-script=./permissions.js ...

The scoping does not necessarily have to be perfect, as just needs to match what the project knows it requires.

There would naturally be a minor performance hit, but this would allow for powerful scoping that would allow for projects to have permissions exactly as fine-grained as they needed.

On our end, the added security benefit far outweighs the performance hit, as it allows for better security during development. For deployment, we can replace the permission model with containers to remove the performance impact.

What alternatives have you considered?

  1. Using a socket-based permission broker: https://docs.deno.com/runtime/fundamentals/security/#permission-broker

  2. Adding regex-based allow-listing for child and net.

Linguagem predominante
JavaScript
Estrelas
123k
Forks
39.3k
Merge médio
4d 16h
PRs com merge (30d)
227

Preparar o ambiente

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de nodejs/node

Todas as issues de nodejs/node

Issues semelhantes

Mais issues de JavaScript

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.