src,permission: add support to permission.has(addon)

PR-URL: #58951
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Ilyas Shabi <ilyasshabi94@gmail.com>

Author: RafaelGSS

node.gyp

@@ -163,6 +163,7 @@
       'src/permission/permission.cc',
       'src/permission/wasi_permission.cc',
       'src/permission/worker_permission.cc',
+      'src/permission/addon_permission.cc',
       'src/pipe_wrap.cc',
       'src/process_wrap.cc',
       'src/signal_wrap.cc',
@@ -292,6 +293,7 @@
       'src/permission/permission.h',
       'src/permission/wasi_permission.h',
       'src/permission/worker_permission.h',
+      'src/permission/addon_permission.h',
       'src/pipe_wrap.h',
       'src/req_wrap.h',
       'src/req_wrap-inl.h',

src/env.cc

@@ -913,6 +913,7 @@ Environment::Environment(IsolateData* isolate_data,
     // unless explicitly allowed by the user
     if (!options_->allow_addons) {
       options_->allow_native_addons = false;
+      permission()->Apply(this, {"*"}, permission::PermissionScope::kAddon);
     }
     flags_ = flags_ | EnvironmentFlags::kNoCreateInspector;
     permission()->Apply(this, {"*"}, permission::PermissionScope::kInspector);

src/permission/addon_permission.cc

@@ -0,0 +1,24 @@
+#include "addon_permission.h"
+
+#include <string>
+
+namespace node {
+
+namespace permission {
+
+// Currently, Addon manage a single state
+// Once denied, it's always denied
+void AddonPermission::Apply(Environment* env,
+                            const std::vector<std::string>& allow,
+                            PermissionScope scope) {
+  deny_all_ = true;
+}
+
+bool AddonPermission::is_granted(Environment* env,
+                                 PermissionScope perm,
+                                 const std::string_view& param) const {
+  return deny_all_ == false;
+}
+
+}  // namespace permission
+}  // namespace node

src/permission/addon_permission.h

@@ -0,0 +1,31 @@
+#ifndef SRC_PERMISSION_ADDON_PERMISSION_H_
+#define SRC_PERMISSION_ADDON_PERMISSION_H_
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#include <string>
+#include "permission/permission_base.h"
+
+namespace node {
+
+namespace permission {
+
+class AddonPermission final : public PermissionBase {
+ public:
+  void Apply(Environment* env,
+             const std::vector<std::string>& allow,
+             PermissionScope scope) override;
+  bool is_granted(Environment* env,
+                  PermissionScope perm,
+                  const std::string_view& param = "") const override;
+
+ private:
+  bool deny_all_;
+};
+
+}  // namespace permission
+
+}  // namespace node
+
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+#endif  // SRC_PERMISSION_ADDON_PERMISSION_H_

src/permission/permission.cc

@@ -84,6 +84,7 @@ Permission::Permission() : enabled_(false) {
   std::shared_ptr<PermissionBase> inspector =
       std::make_shared<InspectorPermission>();
   std::shared_ptr<PermissionBase> wasi = std::make_shared<WASIPermission>();
+  std::shared_ptr<PermissionBase> addon = std::make_shared<AddonPermission>();
 #define V(Name, _, __, ___)                                                    \
   nodes_.insert(std::make_pair(PermissionScope::k##Name, fs));
   FILESYSTEM_PERMISSIONS(V)
@@ -104,6 +105,10 @@ Permission::Permission() : enabled_(false) {
   nodes_.insert(std::make_pair(PermissionScope::k##Name, wasi));
   WASI_PERMISSIONS(V)
 #undef V
+#define V(Name, _, __, ___)                                                    \
+  nodes_.insert(std::make_pair(PermissionScope::k##Name, addon));
+  ADDON_PERMISSIONS(V)
+#undef V
 }
 
 const char* GetErrorFlagSuggestion(node::permission::PermissionScope perm) {

src/permission/permission.h

@@ -5,6 +5,7 @@
 
 #include "debug_utils.h"
 #include "node_options.h"
+#include "permission/addon_permission.h"
 #include "permission/child_process_permission.h"
 #include "permission/fs_permission.h"
 #include "permission/inspector_permission.h"

src/permission/permission_base.h

@@ -29,12 +29,16 @@ namespace permission {
 
 #define INSPECTOR_PERMISSIONS(V) V(Inspector, "inspector", PermissionsRoot, "")
 
+#define ADDON_PERMISSIONS(V)                                                   \
+  V(Addon, "addon", PermissionsRoot, "--allow-addons")
+
 #define PERMISSIONS(V)                                                         \
   FILESYSTEM_PERMISSIONS(V)                                                    \
   CHILD_PROCESS_PERMISSIONS(V)                                                 \
   WASI_PERMISSIONS(V)                                                          \
   WORKER_THREADS_PERMISSIONS(V)                                                \
-  INSPECTOR_PERMISSIONS(V)
+  INSPECTOR_PERMISSIONS(V)                                                     \
+  ADDON_PERMISSIONS(V)
 
 #define V(name, _, __, ___) k##name,
 enum class PermissionScope {

test/parallel/test-permission-allow-addons-cli.js

@@ -19,3 +19,7 @@ const loadFixture = createRequire(fixtures.path('node_modules'));
   const msg = loadFixture('pkgexports/no-addons');
   assert.strictEqual(msg, 'using native addons');
 }
+
+{
+  assert.ok(process.permission.has('addon'));
+}

test/parallel/test-permission-has.js

@@ -25,3 +25,13 @@ const assert = require('assert');
 {
   assert.ok(!process.permission.has('FileSystemWrite', Buffer.from('reference')));
 }
+
+{
+  assert.ok(!process.permission.has('fs'));
+  assert.ok(process.permission.has('fs.read'));
+  assert.ok(!process.permission.has('fs.write'));
+  assert.ok(!process.permission.has('wasi'));
+  assert.ok(!process.permission.has('worker'));
+  assert.ok(!process.permission.has('inspector'));
+  assert.ok(!process.permission.has('addon'));
+}