dandv/deno-named-permissions-stacking

Deno permissions stack: deno -R=foo.txt -R=bar.txt read.ts allows reading both foo.txt and bar.txt.

Named permissions, however, don't: if permission set "foo" allows reading foo.txt, then deno -P=foo -R=bar.txt read.ts should have the same effect as above: allow reading both foo.txt and bar.txt. In Deno v2.7.5, this invocation will only allow reading bar.txt, whose allow-read permission appears to overwrite the read key in the foo permissions set:

$ deno -P=foo -R=bar.txt read.ts
Warning Permissions in the config file is an experimental feature and may change in the future.
┏ ⚠️  Deno requests read access to "foo.txt".

Allowing the request will cause the script to complete successfully, logging both foo.txt and bar.txt, without requesting read access to bar.txt. This confirms the suspicion that -R=bar.txt overwrote the read permission of the foo named permissions set.

The same issue occurs with network permissions. Here's deno.jsonc:

{
  "permissions": {
    "foo": {
      "read": ["foo.txt"],
      "net": ["example.org"],
    }
  }
}

And a script that accesses example.org and www.google.com:

console.log(Deno.readTextFileSync('foo.txt'));
console.log(Deno.readTextFileSync('bar.txt'));

Answer y to the permission prompts:

# Correct: deno asks for permission to access www.google.com
$ deno run -P=foo net.ts
Warning Permissions in the config file is an experimental feature and may change in the future.
✅ Granted net access to "www.google.com:443".

# Bug: deno asks for permission to access example.com,
# despite that being in the `foo` permissions set.
$ deno run -P=foo --allow-net=www.google.com net.ts
Warning Permissions in the config file is an experimental feature and may change in the future.
✅ Granted net access to "example.org:443".

dandv/deno-named-permissions-stacking

README

Contributors

Issues