Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

src,permission: resolve path on fs_permission #52761

Merged
merged 3 commits into from
May 3, 2024

Conversation

RafaelGSS
Copy link
Member

@RafaelGSS RafaelGSS commented Apr 30, 2024

This resolves a known limitation of the permission model by using the new PathResolve method from the C++ side. Therefore, we don't need to resolve all paths on lib/fs.js when the pm is enabled, we do it only when checking is_granted

It's unlikely to happen, but this might affect users relying on resource: being always the absolute path. With this change, resource will be equal to the given param to fs.* calls.

cc: @nodejs/security-wg

Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
@RafaelGSS RafaelGSS added the permission Issues and PRs related to the Permission Model label Apr 30, 2024
@RafaelGSS RafaelGSS requested a review from tniessen April 30, 2024 15:48
@nodejs-github-bot
Copy link
Collaborator

Review requested:

  • @nodejs/security-wg

@nodejs-github-bot nodejs-github-bot added c++ Issues and PRs that require attention from people who are familiar with C++. lib / src Issues and PRs related to general changes in the lib or src directory. needs-ci PRs that need a full CI run. labels Apr 30, 2024
@RafaelGSS RafaelGSS added the request-ci Add this label to start a Jenkins CI on a PR. label Apr 30, 2024
@github-actions github-actions bot added request-ci-failed An error occurred while starting CI via request-ci label, and manual interventon is needed. and removed request-ci Add this label to start a Jenkins CI on a PR. labels Apr 30, 2024
Copy link
Contributor

Failed to start CI
   ⚠  No approving reviews found
   ✘  Refusing to run CI on potentially unsafe PR
https://github.com/nodejs/node/actions/runs/8901141681

@nodejs-github-bot
Copy link
Collaborator

@RafaelGSS RafaelGSS added author ready PRs that have at least one approval, no pending requests for changes, and a CI started. commit-queue Add this label to land a pull request using GitHub Actions. and removed request-ci-failed An error occurred while starting CI via request-ci label, and manual interventon is needed. labels May 2, 2024
@nodejs-github-bot nodejs-github-bot added commit-queue-failed An error occurred while landing this pull request using GitHub Actions. and removed commit-queue Add this label to land a pull request using GitHub Actions. labels May 2, 2024
@nodejs-github-bot
Copy link
Collaborator

Commit Queue failed
- Loading data for nodejs/node/pull/52761
✔  Done loading data for nodejs/node/pull/52761
----------------------------------- PR info ------------------------------------
Title      src,permission: resolve path on fs_permission (#52761)
Author     Rafael Gonzaga  (@RafaelGSS)
Branch     RafaelGSS:convert-paths-on-pm -> nodejs:main
Labels     c++, lib / src, author ready, needs-ci, permission
Commits    3
 - src,permission: resolve path on fs_permission
 - fixup! remove known limitation mention
 - fixup! src,permission: resolve path on fs_permission
Committers 1
 - RafaelGSS 
PR-URL: https://github.com/nodejs/node/pull/52761
Reviewed-By: Marco Ippolito 
------------------------------ Generated metadata ------------------------------
PR-URL: https://github.com/nodejs/node/pull/52761
Reviewed-By: Marco Ippolito 
--------------------------------------------------------------------------------
   ℹ  This PR was created on Tue, 30 Apr 2024 15:48:13 GMT
   ✔  Approvals: 1
   ✔  - Marco Ippolito (@marco-ippolito): https://github.com/nodejs/node/pull/52761#pullrequestreview-2036027210
   ✘  This PR needs to wait 119 more hours to land (or 0 hours if there is one more approval)
   ✔  Last GitHub CI successful
   ℹ  Last Full PR CI on 2024-05-01T14:44:59Z: https://ci.nodejs.org/job/node-test-pull-request/58839/
- Querying data for job/node-test-pull-request/58839/
   ✔  Last Jenkins CI successful
--------------------------------------------------------------------------------
   ✔  Aborted `git node land` session in /home/runner/work/node/node/.ncu
https://github.com/nodejs/node/actions/runs/8926738177

@Trott
Copy link
Member

Trott commented May 2, 2024

It's unlikely to happen, but this might affect users relying on resource: being always the absolute path. With this change, resource will be equal to the given param to fs.* calls.

The feature is experimental and/or deprecated, so breaking changes are permitted anyway, or am I mistaken?

@Trott Trott added commit-queue Add this label to land a pull request using GitHub Actions. and removed commit-queue-failed An error occurred while landing this pull request using GitHub Actions. labels May 2, 2024
@nodejs-github-bot nodejs-github-bot added commit-queue-failed An error occurred while landing this pull request using GitHub Actions. and removed commit-queue Add this label to land a pull request using GitHub Actions. labels May 2, 2024
@nodejs-github-bot
Copy link
Collaborator

Commit Queue failed
- Loading data for nodejs/node/pull/52761
✔  Done loading data for nodejs/node/pull/52761
----------------------------------- PR info ------------------------------------
Title      src,permission: resolve path on fs_permission (#52761)
Author     Rafael Gonzaga  (@RafaelGSS)
Branch     RafaelGSS:convert-paths-on-pm -> nodejs:main
Labels     c++, lib / src, author ready, needs-ci, permission
Commits    3
 - src,permission: resolve path on fs_permission
 - fixup! remove known limitation mention
 - fixup! src,permission: resolve path on fs_permission
Committers 1
 - RafaelGSS 
PR-URL: https://github.com/nodejs/node/pull/52761
Reviewed-By: Marco Ippolito 
Reviewed-By: Rich Trott 
------------------------------ Generated metadata ------------------------------
PR-URL: https://github.com/nodejs/node/pull/52761
Reviewed-By: Marco Ippolito 
Reviewed-By: Rich Trott 
--------------------------------------------------------------------------------
   ℹ  This PR was created on Tue, 30 Apr 2024 15:48:13 GMT
   ✔  Approvals: 2
   ✔  - Marco Ippolito (@marco-ippolito): https://github.com/nodejs/node/pull/52761#pullrequestreview-2036027210
   ✔  - Rich Trott (@Trott): https://github.com/nodejs/node/pull/52761#pullrequestreview-2037076261
   ✔  Last GitHub CI successful
   ℹ  Last Full PR CI on 2024-05-02T15:52:15Z: https://ci.nodejs.org/job/node-test-pull-request/58839/
- Querying data for job/node-test-pull-request/58839/
   ✔  Last Jenkins CI successful
--------------------------------------------------------------------------------
   ✔  No git cherry-pick in progress
   ✔  No git am in progress
   ✔  No git rebase in progress
--------------------------------------------------------------------------------
- Bringing origin/main up to date...
From https://github.com/nodejs/node
 * branch                  main       -> FETCH_HEAD
✔  origin/main is now up-to-date
- Downloading patch for 52761
From https://github.com/nodejs/node
 * branch                  refs/pull/52761/merge -> FETCH_HEAD
✔  Fetched commits as c5cfdd48497f..8e3a422dfa6b
--------------------------------------------------------------------------------
Auto-merging src/node_modules.cc
[main 75b0cdb2a9] src,permission: resolve path on fs_permission
 Author: RafaelGSS 
 Date: Mon Apr 29 16:44:08 2024 -0300
 20 files changed, 107 insertions(+), 136 deletions(-)
 delete mode 100644 test/known_issues/test-permission-model-path-resolution.js
[main 90396f1840] fixup! remove known limitation mention
 Author: RafaelGSS 
 Date: Tue Apr 30 12:49:25 2024 -0300
 1 file changed, 2 deletions(-)
[main 47716ed756] fixup! src,permission: resolve path on fs_permission
 Author: RafaelGSS 
 Date: Tue Apr 30 12:52:09 2024 -0300
 11 files changed, 31 insertions(+), 63 deletions(-)
   ✔  Patches applied
There are 3 commits in the PR. Attempting autorebase.
Rebasing (2/5)
Rebasing (3/5)

Executing: git node land --amend --yes
--------------------------------- New Message ----------------------------------
src,permission: resolve path on fs_permission

Signed-off-by: RafaelGSS rafael.nunu@hotmail.com
PR-URL: #52761
Reviewed-By: Marco Ippolito marcoippolito54@gmail.com
Reviewed-By: Rich Trott rtrott@gmail.com

[detached HEAD 93ede0c8c1] src,permission: resolve path on fs_permission
Author: RafaelGSS rafael.nunu@hotmail.com
Date: Mon Apr 29 16:44:08 2024 -0300
20 files changed, 68 insertions(+), 129 deletions(-)
delete mode 100644 test/known_issues/test-permission-model-path-resolution.js
Rebasing (4/5)
Rebasing (5/5)

Executing: git node land --amend --yes
--------------------------------- New Message ----------------------------------
fixup! remove known limitation mention

PR-URL: #52761
Reviewed-By: Marco Ippolito marcoippolito54@gmail.com
Reviewed-By: Rich Trott rtrott@gmail.com

[detached HEAD 2c028a1c18] fixup! remove known limitation mention
Author: RafaelGSS rafael.nunu@hotmail.com
Date: Tue Apr 30 12:49:25 2024 -0300
1 file changed, 2 deletions(-)

Successfully rebased and updated refs/heads/main.

ℹ Add commit-queue-squash label to land the PR as one commit, or commit-queue-rebase to land as separate commits.

https://github.com/nodejs/node/actions/runs/8931416871

@RafaelGSS RafaelGSS added commit-queue Add this label to land a pull request using GitHub Actions. commit-queue-squash Add this label to instruct the Commit Queue to squash all the PR commits into the first one. and removed commit-queue-failed An error occurred while landing this pull request using GitHub Actions. labels May 3, 2024
@nodejs-github-bot nodejs-github-bot removed the commit-queue Add this label to land a pull request using GitHub Actions. label May 3, 2024
@nodejs-github-bot nodejs-github-bot merged commit 15456e4 into nodejs:main May 3, 2024
75 checks passed
@nodejs-github-bot
Copy link
Collaborator

Landed in 15456e4

Ch3nYuY pushed a commit to Ch3nYuY/node that referenced this pull request May 8, 2024
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: nodejs#52761
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
targos pushed a commit that referenced this pull request May 8, 2024
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: #52761
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
@marco-ippolito marco-ippolito added the backport-requested-v20.x PRs awaiting manual backport to the v20.x-staging branch. label Jun 17, 2024
@marco-ippolito
Copy link
Member

If we want to land this on v20 it requires manual backport

eliphazbouye pushed a commit to eliphazbouye/node that referenced this pull request Jun 20, 2024
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: nodejs#52761
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
bmeck pushed a commit to bmeck/node that referenced this pull request Jun 22, 2024
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: nodejs#52761
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
author ready PRs that have at least one approval, no pending requests for changes, and a CI started. backport-requested-v20.x PRs awaiting manual backport to the v20.x-staging branch. c++ Issues and PRs that require attention from people who are familiar with C++. commit-queue-squash Add this label to instruct the Commit Queue to squash all the PR commits into the first one. lib / src Issues and PRs related to general changes in the lib or src directory. needs-ci PRs that need a full CI run. permission Issues and PRs related to the Permission Model
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants