Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Feat/pm resolve #4

Merged
merged 9 commits into from
Nov 16, 2023
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 8 additions & 4 deletions src/env.cc
Original file line number Diff line number Diff line change
Expand Up @@ -858,20 +858,24 @@ Environment::Environment(IsolateData* isolate_data,
flags_ = flags_ | EnvironmentFlags::kNoCreateInspector;
permission()->Apply(this, "*", permission::PermissionScope::kInspector);
if (!options_->allow_child_process) {
permission()->Apply(this, "*", permission::PermissionScope::kChildProcess);
permission()->Apply(
this, "*", permission::PermissionScope::kChildProcess);
}
if (!options_->allow_worker_threads) {
permission()->Apply(this, "*", permission::PermissionScope::kWorkerThreads);
permission()->Apply(
this, "*", permission::PermissionScope::kWorkerThreads);
}
}

if (!options_->allow_fs_read.empty()) {
permission()->Apply(this, options_->allow_fs_read,
permission()->Apply(this,
options_->allow_fs_read,
permission::PermissionScope::kFileSystemRead);
}

if (!options_->allow_fs_write.empty()) {
permission()->Apply(this, options_->allow_fs_write,
permission()->Apply(this,
options_->allow_fs_write,
permission::PermissionScope::kFileSystemWrite);
}
}
Expand Down
3 changes: 2 additions & 1 deletion src/permission/child_process_permission.cc
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,8 @@ namespace permission {

// Currently, ChildProcess manage a single state
// Once denied, it's always denied
void ChildProcessPermission::Apply(Environment* env, const std::string& allow,
void ChildProcessPermission::Apply(Environment* env,
const std::string& allow,
PermissionScope scope) {
deny_all_ = true;
}
Expand Down
4 changes: 3 additions & 1 deletion src/permission/child_process_permission.h
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,9 @@ namespace permission {

class ChildProcessPermission final : public PermissionBase {
public:
void Apply(Environment* env, const std::string& allow, PermissionScope scope) override;
void Apply(Environment* env,
const std::string& allow,
PermissionScope scope) override;
bool is_granted(PermissionScope perm,
const std::string_view& param = "") override;

Expand Down
11 changes: 4 additions & 7 deletions src/permission/fs_permission.cc
Original file line number Diff line number Diff line change
Expand Up @@ -116,7 +116,9 @@ namespace permission {

// allow = '*'
// allow = '/tmp/,/home/example.js'
void FSPermission::Apply(Environment* env, const std::string& allow, PermissionScope scope) {
void FSPermission::Apply(Environment* env,
const std::string& allow,
PermissionScope scope) {
using std::string_view_literals::operator""sv;
for (const std::string_view res : SplitString(allow, ","sv)) {
if (res == "*"sv) {
Expand All @@ -129,16 +131,11 @@ void FSPermission::Apply(Environment* env, const std::string& allow, PermissionS
}
return;
}
GrantAccess(
scope,
PathResolve(env, { { res.data(), res.size() } })
);
GrantAccess(scope, PathResolve(env, {{res.data(), res.size()}}));
}
}

void FSPermission::GrantAccess(PermissionScope perm, const std::string& res) {
std::cout << "Result: " << res << std::endl;

const std::string path = WildcardIfDir(res);
if (perm == PermissionScope::kFileSystemRead) {
granted_in_fs_.Insert(path);
Expand Down
4 changes: 3 additions & 1 deletion src/permission/fs_permission.h
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,9 @@ namespace permission {

class FSPermission final : public PermissionBase {
public:
void Apply(Environment* env, const std::string& allow, PermissionScope scope) override;
void Apply(Environment* env,
const std::string& allow,
PermissionScope scope) override;
bool is_granted(PermissionScope perm, const std::string_view& param) override;

struct RadixTree {
Expand Down
3 changes: 2 additions & 1 deletion src/permission/inspector_permission.cc
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,8 @@ namespace permission {

// Currently, Inspector manage a single state
// Once denied, it's always denied
void InspectorPermission::Apply(Environment* env, const std::string& allow,
void InspectorPermission::Apply(Environment* env,
const std::string& allow,
PermissionScope scope) {
deny_all_ = true;
}
Expand Down
4 changes: 3 additions & 1 deletion src/permission/inspector_permission.h
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,9 @@ namespace permission {

class InspectorPermission final : public PermissionBase {
public:
void Apply(Environment* env, const std::string& allow, PermissionScope scope) override;
void Apply(Environment* env,
const std::string& allow,
PermissionScope scope) override;
bool is_granted(PermissionScope perm,
const std::string_view& param = "") override;

Expand Down
4 changes: 3 additions & 1 deletion src/permission/permission.cc
Original file line number Diff line number Diff line change
Expand Up @@ -130,7 +130,9 @@ void Permission::EnablePermissions() {
}
}

void Permission::Apply(Environment* env, const std::string& allow, PermissionScope scope) {
void Permission::Apply(Environment* env,
const std::string& allow,
PermissionScope scope) {
auto permission = nodes_.find(scope);
if (permission != nodes_.end()) {
permission->second->Apply(env, allow, scope);
Expand Down
4 changes: 3 additions & 1 deletion src/permission/permission_base.h
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,9 @@ enum class PermissionScope {

class PermissionBase {
public:
virtual void Apply(Environment* env, const std::string& allow, PermissionScope scope) = 0;
virtual void Apply(Environment* env,
const std::string& allow,
PermissionScope scope) = 0;
virtual bool is_granted(PermissionScope perm,
const std::string_view& param = "") = 0;
};
Expand Down
4 changes: 3 additions & 1 deletion src/permission/worker_permission.cc
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,9 @@ namespace permission {

// Currently, PolicyDenyWorker manage a single state
// Once denied, it's always denied
void WorkerPermission::Apply(Environment* env, const std::string& allow, PermissionScope scope) {
void WorkerPermission::Apply(Environment* env,
const std::string& allow,
PermissionScope scope) {
deny_all_ = true;
}

Expand Down
4 changes: 3 additions & 1 deletion src/permission/worker_permission.h
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,9 @@ namespace permission {

class WorkerPermission final : public PermissionBase {
public:
void Apply(Environment* env, const std::string& allow, PermissionScope scope) override;
void Apply(Environment* env,
const std::string& allow,
PermissionScope scope) override;
bool is_granted(PermissionScope perm,
const std::string_view& param = "") override;

Expand Down
Loading
Loading