denoland-deno/cli/tests/testdata/run/permission_request_long.ts at 568337f3f43ef050cbbd95995f94e39663530ab4 - foster/denoland-deno - Foster's Laboratory

foster/denoland-deno

mirror of https://github.com/denoland/deno.git synced 2024-11-28 16:20:57 -05:00

Matt Mastracci 00970daea2

fix(cli): harden permission stdio check (#21778 )

Harden the code that does permission checks to protect against
re-opening of stdin.

Code that runs FFI is vulnerable to an attack where fd 0 is closed
during a permission check and re-opened with a file that contains a
positive response (ie: `y` or `A`). While FFI code is dangerous in
general, we can make it more difficult for FFI-enabled code to bypass
additional permission checks.

- Checks to see if the underlying file for stdin has changed from the
start to the end of the permission check (detects races)
- Checks to see if the message is excessively long (lowering the window
for races)
- Checks to see if stdin and stderr are still terminals at the end of
the function (making races more difficult)

2024-01-04 00:31:39 +01:00

1 line

28 B

TypeScript

Raw Blame History

Deno.open("a".repeat(1e5));