Permissions whitelist

cli/deno_dir.rs

@@ -291,36 +291,14 @@ impl DenoDir {
     referrer: &str,
   ) -> Result<Url, url::ParseError> {
     let specifier = self.src_file_to_url(specifier);
-    let mut referrer = self.src_file_to_url(referrer);
+    let referrer = self.src_file_to_url(referrer);
 
     debug!(
       "resolve_module specifier {} referrer {}",
       specifier, referrer
     );
 
-    if referrer.starts_with('.') {
-      let cwd = std::env::current_dir().unwrap();
-      let referrer_path = cwd.join(referrer);
-      referrer = referrer_path.to_str().unwrap().to_string() + "/";
-    }
-
-    let j = if is_remote(&specifier)
-      || (Path::new(&specifier).is_absolute() && !is_remote(&referrer))
-    {
-      parse_local_or_remote(&specifier)?
-    } else if referrer.ends_with('/') {
-      let r = Url::from_directory_path(&referrer);
-      // TODO(ry) Properly handle error.
-      if r.is_err() {
-        error!("Url::from_directory_path error {}", referrer);
-      }
-      let base = r.unwrap();
-      base.join(specifier.as_ref())?
-    } else {
-      let base = parse_local_or_remote(&referrer)?;
-      base.join(specifier.as_ref())?
-    };
-    Ok(j)
+    resolve_file_url(specifier, referrer)
   }
 
   /// Returns (module name, local filename)
@@ -889,6 +867,35 @@ fn save_source_code_headers(
   }
 }
 
+pub fn resolve_file_url(
+  specifier: String,
+  mut referrer: String,
+) -> Result<Url, url::ParseError> {
+  if referrer.starts_with('.') {
+    let cwd = std::env::current_dir().unwrap();
+    let referrer_path = cwd.join(referrer);
+    referrer = referrer_path.to_str().unwrap().to_string() + "/";
+  }
+
+  let j = if is_remote(&specifier)
+    || (Path::new(&specifier).is_absolute() && !is_remote(&referrer))
+  {
+    parse_local_or_remote(&specifier)?
+  } else if referrer.ends_with('/') {
+    let r = Url::from_directory_path(&referrer);
+    // TODO(ry) Properly handle error.
+    if r.is_err() {
+      error!("Url::from_directory_path error {}", referrer);
+    }
+    let base = r.unwrap();
+    base.join(specifier.as_ref())?
+  } else {
+    let base = parse_local_or_remote(&referrer)?;
+    base.join(specifier.as_ref())?
+  };
+  Ok(j)
+}
+
 #[cfg(test)]
 mod tests {
   use super::*;

cli/flags.rs

@@ -16,8 +16,11 @@ pub struct DenoFlags {
   /// the path passed on the command line, otherwise `None`.
   pub config_path: Option<String>,
   pub allow_read: bool,
+  pub read_whitelist: Vec<String>,
   pub allow_write: bool,
+  pub write_whitelist: Vec<String>,
   pub allow_net: bool,
+  pub net_whitelist: Vec<String>,
   pub allow_env: bool,
   pub allow_run: bool,
   pub allow_high_precision: bool,
@@ -186,17 +189,29 @@ ability to spawn subprocesses.
 ",
         ).arg(
           Arg::with_name("allow-read")
-            .long("allow-read")
-            .help("Allow file system read access"),
-        ).arg(
-          Arg::with_name("allow-write")
-            .long("allow-write")
-            .help("Allow file system write access"),
-        ).arg(
-          Arg::with_name("allow-net")
-            .long("allow-net")
-            .help("Allow network access"),
-        ).arg(
+        .long("allow-read")
+        .min_values(0)
+        .takes_value(true)
+        .use_delimiter(true)
+        .require_equals(true)
+        .help("Allow file system read access"),
+    ).arg(
+      Arg::with_name("allow-write")
+        .long("allow-write")
+        .min_values(0)
+        .takes_value(true)
+        .use_delimiter(true)
+        .require_equals(true)
+        .help("Allow file system write access"),
+    ).arg(
+      Arg::with_name("allow-net")
+        .long("allow-net")
+        .min_values(0)
+        .takes_value(true)
+        .use_delimiter(true)
+        .require_equals(true)
+        .help("Allow network access"),
+    ).arg(
           Arg::with_name("allow-env")
             .long("allow-env")
             .help("Allow environment access"),
@@ -290,13 +305,31 @@ pub fn parse_flags(matches: ArgMatches) -> DenoFlags {
   // flags specific to "run" subcommand
   if let Some(run_matches) = matches.subcommand_matches("run") {
     if run_matches.is_present("allow-read") {
-      flags.allow_read = true;
+      if run_matches.value_of("allow-read").is_some() {
+        let read_wl = run_matches.values_of("allow-read").unwrap();
+        flags.read_whitelist =
+          read_wl.map(std::string::ToString::to_string).collect();
+      } else {
+        flags.allow_read = true;
+      }
     }
     if run_matches.is_present("allow-write") {
-      flags.allow_write = true;
+      if run_matches.value_of("allow-write").is_some() {
+        let write_wl = run_matches.values_of("allow-write").unwrap();
+        flags.write_whitelist =
+          write_wl.map(std::string::ToString::to_string).collect();
+      } else {
+        flags.allow_write = true;
+      }
     }
     if run_matches.is_present("allow-net") {
-      flags.allow_net = true;
+      if run_matches.value_of("allow-net").is_some() {
+        let net_wl = run_matches.values_of("allow-net").unwrap();
+        flags.net_whitelist =
+          net_wl.map(std::string::ToString::to_string).collect();
+      } else {
+        flags.allow_net = true;
+      }
     }
     if run_matches.is_present("allow-env") {
       flags.allow_env = true;
@@ -752,4 +785,61 @@ mod tests {
     assert_eq!(subcommand, DenoSubcommand::Xeval);
     assert_eq!(argv, svec!["deno", "console.log(val)"]);
   }
+  #[test]
+  fn test_flags_from_vec_19() {
+    let (flags, subcommand, argv) = flags_from_vec(svec![
+      "deno",
+      "run",
+      "--allow-read=/some/test/dir",
+      "script.ts"
+    ]);
+    assert_eq!(
+      flags,
+      DenoFlags {
+        allow_read: false,
+        read_whitelist: svec!["/some/test/dir"],
+        ..DenoFlags::default()
+      }
+    );
+    assert_eq!(subcommand, DenoSubcommand::Run);
+    assert_eq!(argv, svec!["deno", "script.ts"]);
+  }
+  #[test]
+  fn test_flags_from_vec_20() {
+    let (flags, subcommand, argv) = flags_from_vec(svec![
+      "deno",
+      "run",
+      "--allow-write=/some/test/dir",
+      "script.ts"
+    ]);
+    assert_eq!(
+      flags,
+      DenoFlags {
+        allow_write: false,
+        write_whitelist: svec!["/some/test/dir"],
+        ..DenoFlags::default()
+      }
+    );
+    assert_eq!(subcommand, DenoSubcommand::Run);
+    assert_eq!(argv, svec!["deno", "script.ts"]);
+  }
+  #[test]
+  fn test_flags_from_vec_21() {
+    let (flags, subcommand, argv) = flags_from_vec(svec![
+      "deno",
+      "run",
+      "--allow-net=127.0.0.1",
+      "script.ts"
+    ]);
+    assert_eq!(
+      flags,
+      DenoFlags {
+        allow_net: false,
+        net_whitelist: svec!["127.0.0.1"],
+        ..DenoFlags::default()
+      }
+    );
+    assert_eq!(subcommand, DenoSubcommand::Run);
+    assert_eq!(argv, svec!["deno", "script.ts"]);
+  }
 }