BREAKING: execPath should require allow-read (#5109)

cli/js/lib.deno.ns.d.ts

@@ -147,7 +147,7 @@ declare namespace Deno {
    *
    *       console.log(Deno.execPath());  // e.g. "/home/alice/.local/bin/deno"
    *
-   * Requires `allow-env` permission.
+   * Requires `allow-read` permission.
    */
   export function execPath(): string;
 

cli/js/tests/os_test.ts

@@ -48,7 +48,10 @@ unitTest(function envPermissionDenied2(): void {
 // case-insensitive. Case normalization needs be done using the collation
 // that Windows uses, rather than naively using String.toLowerCase().
 unitTest(
-  { ignore: Deno.build.os !== "windows", perms: { env: true, run: true } },
+  {
+    ignore: Deno.build.os !== "windows",
+    perms: { read: true, env: true, run: true },
+  },
   async function envCaseInsensitive() {
     // Utility function that runs a Deno subprocess with the environment
     // specified in `inputEnv`. The subprocess reads the environment variables
@@ -269,11 +272,11 @@ unitTest(function getDirWithoutPermission(): void {
   );
 });
 
-unitTest({ perms: { env: true } }, function execPath(): void {
+unitTest({ perms: { read: true } }, function execPath(): void {
   assertNotEquals(Deno.execPath(), "");
 });
 
-unitTest({ perms: { env: false } }, function execPathPerm(): void {
+unitTest({ perms: { read: false } }, function execPathPerm(): void {
   let caughtError = false;
   try {
     Deno.execPath();

cli/ops/os.rs

@@ -82,8 +82,8 @@ fn op_exec_path(
   _args: Value,
   _zero_copy: Option<ZeroCopyBuf>,
 ) -> Result<JsonOp, OpError> {
-  state.check_env()?;
   let current_exe = env::current_exe().unwrap();
+  state.check_read(&current_exe)?;
   // Now apply URL parser to current exe to get fully resolved path, otherwise
   // we might get `./` and `../` bits in `exec_path`
   let exe_url = Url::from_file_path(current_exe).unwrap();

cli/tests/integration_tests.rs

@@ -2421,6 +2421,27 @@ async fn inspector_does_not_hang() {
   assert!(child.wait().unwrap().success());
 }
 
+#[test]
+fn exec_path() {
+  let output = util::deno_cmd()
+    .current_dir(util::root_path())
+    .arg("run")
+    .arg("--allow-read")
+    .arg("cli/tests/exec_path.ts")
+    .stdout(std::process::Stdio::piped())
+    .spawn()
+    .unwrap()
+    .wait_with_output()
+    .unwrap();
+  assert!(output.status.success());
+  let stdout_str = std::str::from_utf8(&output.stdout).unwrap().trim();
+  let actual =
+    std::fs::canonicalize(&std::path::Path::new(stdout_str)).unwrap();
+  let expected =
+    std::fs::canonicalize(deno::test_util::deno_exe_path()).unwrap();
+  assert_eq!(expected, actual);
+}
+
 mod util {
   use deno::colors::strip_ansi_codes;
   pub use deno::test_util::*;

tools/target_test.py

@@ -31,23 +31,6 @@ class TestTarget(DenoTestCase):
         result = run_output([self.deno_exe, "run", t], quiet=True)
         assert result.out.strip() == "noColor false"
 
-    def test_exec_path(self):
-        cmd = [
-            self.deno_exe, "run", "--allow-run", "--allow-env",
-            "cli/tests/exec_path.ts"
-        ]
-        result = run_output(cmd, quiet=True)
-        print "exec_path", result
-        self.assertEqual(result.code, 0)
-        if os.name == "nt":
-            # When running in github actions, the windows drive letter of the
-            # executable path reported by deno has a different case than the one
-            # reported by python.
-            assert self.deno_exe.upper() in result.out.strip().upper()
-            assert self.deno_exe[1:] in result.out.strip()
-        else:
-            assert self.deno_exe in result.out.strip()
-
 
 if __name__ == "__main__":
     run_tests()