mirror of
https://github.com/nodejs/node.git
synced 2026-10-28 10:15:07 +08:00
James M Snell
f378cfcfbf
Necessarily semver-major. When `--permission` is on, every env var not matched by `--allow-env` is removed at startup. It takes names, prefix patterns (`PREFIX_*`), or `*`, repeatable or comma-sep'd. There are a range of env vars that Node.js itself uses, and a default range that are generally known to be safe in common usage. These are never scrubbed. These include things like `NODE_OPTIONS`, `NODE_EXTRA_CA_CERTS`, `PATH`, `HOME`, etc. `NODE_ENV` is not in the defaults and must be allowed explicitly. Proxy vars (`HTTP_PROXY`, `HTTPS_PROXY`, `NO_PROXY`) are also not in the defaults since they can carry credentials. When `--use-env-proxy` or `NODE_USE_ENV_PROXY` is set and any of them were removed, a single warning naming them is emitted. Env vars can be dropped at runtime after reading using `permission.drop()`. This is a stronger protection than using `process.env.FOO = undefined` because it will scrub the env var also from the environment block. On Linux, the removed entries are overwritten in the initial environment block. fs reads of any other process's /proc/<pid>/environ, ancestors included, are denied regardless of `--allow-fs-read`. A process's own is readable only with `--allow-env=*`. Symlinks are resolved before the check so paths like /dev/fd/../../<ppid>/environ are caught. The check only canonicalizes paths that statfs() reports are on procfs. On Windows, removal also clears the C runtime's copy of the environ using _wputenv_s. Reading a removed name returns undefined, warns once per name, and publishes to a diagnostics channel. Env file keys are allowed. If the user had reason to pass in an env file the assumption is they meant to allow them. File-source config (node.config.json and NODE_OPTIONS from a .env file) can only narrow the allow list. Embedders must call ScrubProcessEnvironment() themselves on startup. This is left up to the embedder to determine the exact timing but needs to be called before startup actually happens. Child processes are started with `--allow-env=*`. Those either receive the explicit env they were started with or only the env they inherit from the parent. Since the parent process is scrubbed, and the child cannot read any other process's /proc/<pid>/environ, it should never see more than the parent can. Main part of the impl was done by hand. Docs, tests, verification pass, and cleanup nits were automated. Signed-off-by: James M Snell <jasnell@gmail.com> Assisted-by: Opencode PR-URL: https://github.com/nodejs/node/pull/66132 Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
91 lines
2.9 KiB
JavaScript
91 lines
2.9 KiB
JavaScript
'use strict';
|
|
|
|
const common = require('../common');
|
|
const assert = require('node:assert');
|
|
const fs = require('node:fs');
|
|
const path = require('node:path');
|
|
const { spawnSync } = require('node:child_process');
|
|
const tmpdir = require('../common/tmpdir');
|
|
|
|
tmpdir.refresh();
|
|
|
|
const allowed = tmpdir.resolve('allowed');
|
|
const blocked = tmpdir.resolve('blocked');
|
|
fs.mkdirSync(path.join(allowed, 'a', 'b'), { recursive: true });
|
|
fs.mkdirSync(path.join(allowed, 'c'));
|
|
fs.mkdirSync(blocked);
|
|
fs.writeFileSync(path.join(allowed, 'top'), '');
|
|
fs.writeFileSync(path.join(allowed, 'a', '1'), '');
|
|
fs.writeFileSync(path.join(allowed, 'a', 'b', '2'), '');
|
|
fs.writeFileSync(path.join(blocked, 'secret'), '');
|
|
if (common.canCreateSymLink()) {
|
|
fs.symlinkSync(path.join(allowed, 'a'), path.join(allowed, 'c', 'link-to-a'), 'dir');
|
|
}
|
|
|
|
// Computed without the permission model, so by the native walk.
|
|
const expected = fs.readdirSync(allowed, { recursive: true });
|
|
assert(expected.includes(path.join('a', 'b', '2')));
|
|
|
|
const { status, stderr } = spawnSync(process.execPath, [
|
|
'--permission',
|
|
'--allow-env=ALLOWED,BLOCKED,EXPECTED',
|
|
`--allow-fs-read=${allowed}`,
|
|
'-e',
|
|
`
|
|
const assert = require('assert');
|
|
const fs = require('fs');
|
|
const path = require('path');
|
|
const { ALLOWED, BLOCKED } = process.env;
|
|
const expected = JSON.parse(process.env.EXPECTED);
|
|
const denied = {
|
|
code: 'ERR_ACCESS_DENIED',
|
|
permission: 'FileSystemRead',
|
|
resource: path.toNamespacedPath(BLOCKED),
|
|
};
|
|
|
|
function check(result, withFileTypes) {
|
|
if (!withFileTypes) {
|
|
assert.deepStrictEqual(result, expected);
|
|
return;
|
|
}
|
|
assert(result.every((dirent) => dirent instanceof fs.Dirent));
|
|
assert.deepStrictEqual(
|
|
result.map((dirent) => path.join(path.relative(ALLOWED, dirent.parentPath), dirent.name)),
|
|
expected,
|
|
);
|
|
}
|
|
|
|
let pending = 0;
|
|
process.on('exit', () => assert.strictEqual(pending, 0));
|
|
for (const withFileTypes of [false, true]) {
|
|
const options = { recursive: true, withFileTypes };
|
|
check(fs.readdirSync(ALLOWED, options), withFileTypes);
|
|
assert.throws(() => fs.readdirSync(BLOCKED, options), denied);
|
|
|
|
pending += 4;
|
|
fs.readdir(ALLOWED, options, (err, result) => {
|
|
assert.ifError(err);
|
|
check(result, withFileTypes);
|
|
pending--;
|
|
});
|
|
fs.readdir(BLOCKED, options, (err) => {
|
|
assert.throws(() => { throw err; }, denied);
|
|
pending--;
|
|
});
|
|
fs.promises.readdir(ALLOWED, options).then((result) => {
|
|
check(result, withFileTypes);
|
|
pending--;
|
|
});
|
|
assert.rejects(fs.promises.readdir(BLOCKED, options), denied).then(() => pending--);
|
|
}
|
|
`,
|
|
], {
|
|
env: {
|
|
...process.env,
|
|
ALLOWED: allowed,
|
|
BLOCKED: blocked,
|
|
EXPECTED: JSON.stringify(expected),
|
|
},
|
|
});
|
|
assert.strictEqual(status, 0, stderr.toString());
|