denoland / deno

A modern runtime for JavaScript and TypeScript.
https://deno.com
MIT License
98.06k stars 5.4k forks source link

Can't escalate parent thread permissions with restricted `--allow-run` permissions #21123

Open lowlighter opened 1 year ago

lowlighter commented 1 year ago

Calling Deno.test with restricted --allow-run permissions throw despite the run permissions being a subset of what is allowed:

Deno.test("test", {permissions:{run:["deno"]}}, async () => {
  const command = new Deno.Command("deno", {args:["info"]})
  await command.output()
})
> deno test --allow-run=deno test.ts
running 1 test from ./test.ts
test ... FAILED (2ms)

 ERRORS

test => ./test.ts:1:6
error: PermissionDenied: Can't escalate parent thread permissions
    at pledgePermissions (ext:cli/40_testing.js:560:14)
    at applyPermissions (ext:cli/40_testing.js:571:19)
    at outerWrapped (ext:cli/40_testing.js:489:20)

 FAILURES

test => ./test.ts:1:6

FAILED | 0 passed | 1 failed (3ms)

error: Test failed

Works as expected when full --allow-run permissions given

> deno test --allow-run test.ts
running 1 test from ./test.ts
test ... ok (21ms)

ok | 1 passed | 0 failed (23ms)

Expected behaviour is that it should works in both case, as the first example does not inquire for additional permissions and therefore isn't an escalation attempt.


deno 1.38.0 (release, x86_64-pc-windows-msvc)
v8 12.0.267.1
typescript 5.2.2
lowlighter commented 1 year ago

Also it'd be nice to know which request path(s) caused the issue to make it easier for debugging (kind like what happens when missing permissions in run where the error message tells you what resources it tried to access)