Allow wildcards in --allow-net allow lists.

[erisanolasheni]

It will be good to allow wildcards in the --allow-net allow lists.

For example, this code throws errors:

//Import the server module
await fetch('https://facebook.com')

deno run --allow-net=facebook.com server.js

Because https://facebook.com redirects to https://www.facebook.com

This should be possible to run it;
deno run --allow-net=*.facebook.com server.js

Port based wildcards might also be good. For example
https only
deno run --allow-net=https://* server.js
or
deno run --allow-net=*/**:443 server.js

[Spoonbender]

Just to clarify a nuance here:
IMO --allow-net=https://* server.js should not be equivalent to --allow-net=*/**:443 server.js:
The first one is scheme based (protocol-based), and should allow me to access everything using HTTPS, even if the server-side port is not 443 (i.e. https://somewhere.com:1234 should work).
The second one is port-based, and should allow me to access everything on port 443, even via non-HTTPS protocols such as HTTP, AMQP, MQTT etc. (i.e. amqp://somwhere:443 should work).

[erisanolasheni]

Yes you are right.

[mbrevoort]

This especially! --allow-net=*.slack.com 🙏

[Grunet]

Ran into this just now with the aws sdk.

Was wanting to limit to something like cloudformation.*.amazonaws.com, where the wildcard would match the region

[erisanolasheni]

Hi @ry this issue has been open for 2 years and we haven't heard any positive response about it, anything going on with this?

[bartlomieju]

There is no movement on this front whatsoever. I will raise this topic on the next design meeting.

[erisanolasheni]

Okay, thanks for your concern.

[bartlomieju]

While this is not a priority for the core team, we would be happy to accept a PR that implements wildcard matching for --allow-net flag.

[Grunet]

Am I on base in thinking that the changes would be in this permissions.rs file, specifically UnaryPermission<NetDescriptor>'s 3 "check" methods (check, check_url, and check_all)?

I don't really know Rust (or how to read it...) but that's where I got to after some code tracing.