src,permission: add --allow-net permission #58517
Merged
+681
−19
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
RafaelGSS
added
wip
|
Review requested:
|
nodejs-github-bot
added
lib / src
|
🚀 |
RafaelGSS
force-pushed
the
add-permission-model-to-net
branch
from
f5e6c64 to
3e95997
Compare
RafaelGSS
added
the
semver-major
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
RafaelGSS
force-pushed
the
add-permission-model-to-net
branch
from
3e95997 to
da26847
Compare
|
Is this emitting a warning? |
Now, it is 😄 |
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #58517 +/- ##
==========================================
- Coverage 90.20% 90.13% -0.07%
==========================================
Files 633 639 +6
Lines 186852 188076 +1224
Branches 36690 36902 +212
==========================================
+ Hits 168550 169525 +975
- Misses 11090 11294 +204
- Partials 7212 7257 +45
🚀 New features to boost your workflow:
|
Ethan-Arrowood
approved these changes
Jun 10, 2025
github-actions
bot
removed
the
request-ci
RafaelGSS
added
the
author ready
RafaelGSS
force-pushed
the
add-permission-model-to-net
branch
from
e148039 to
062d335
Compare
|
I had to push a small test fix for websocket (when no openssl). Could you please re-approve? @mcollina @Ethan-Arrowood |
Ethan-Arrowood
approved these changes
Jun 16, 2025
Comment on lines
+17
to
+18
| // TODO(rafaelgss): make this test more comprehensive | ||
| ws.addEventListener('error', common.mustCall()); |
There was a problem hiding this comment.
This was fixed here: nodejs/undici#4274 so once that lands we can update this test to assert cause
RafaelGSS
added
the
commit-queue
nodejs-github-bot
added
commit-queue-failed
Commit Queue failed- Loading data for nodejs/node/pull/58517 ✔ Done loading data for nodejs/node/pull/58517 ----------------------------------- PR info ------------------------------------ Title src,permission: add --allow-net permission (#58517) Author Rafael Gonzaga <rafael.nunu@hotmail.com> (@RafaelGSS) Branch RafaelGSS:add-permission-model-to-net -> nodejs:main Labels semver-major, lib / src, author ready, needs-ci, permission Commits 2 - src,permission: add --allow-net permission - fixup! src,permission: add --allow-net permission Committers 1 - RafaelGSS <rafael.nunu@hotmail.com> PR-URL: https://github.com/nodejs/node/pull/58517 Reviewed-By: Ethan Arrowood <ethan@arrowood.dev> Reviewed-By: Matteo Collina <matteo.collina@gmail.com> ------------------------------ Generated metadata ------------------------------ PR-URL: https://github.com/nodejs/node/pull/58517 Reviewed-By: Ethan Arrowood <ethan@arrowood.dev> Reviewed-By: Matteo Collina <matteo.collina@gmail.com> -------------------------------------------------------------------------------- ℹ This PR was created on Fri, 30 May 2025 20:53:53 GMT ✔ Approvals: 2 ✔ - Ethan Arrowood (@Ethan-Arrowood): https://github.com/nodejs/node/pull/58517#pullrequestreview-2932137688 ✔ - Matteo Collina (@mcollina) (TSC): https://github.com/nodejs/node/pull/58517#pullrequestreview-2914481831 ✘ semver-major requires at least 2 TSC approvals ✔ Last GitHub CI successful ℹ Last Full PR CI on 2025-06-14T00:21:55Z: https://ci.nodejs.org/job/node-test-pull-request/67432/ - Querying data for job/node-test-pull-request/67432/ ✔ Last Jenkins CI successful -------------------------------------------------------------------------------- ✔ Aborted `git node land` session in /home/runner/work/node/node/.ncuhttps://github.com/nodejs/node/actions/runs/15682641187 |
|
Ping @nodejs/tsc for another TSC approval. |
RafaelGSS
removed
the
commit-queue-failed
RaisinTen
approved these changes
Jun 17, 2025
RafaelGSS
added
the
commit-queue
nodejs-github-bot
removed
the
commit-queue
|
Landed in 462c741 |
RafaelGSS
added
the
notable-change
|
The
notable-change
Please suggest a text for the release notes if you'd like to include a more detailed summary, then proceed to update the PR description with the text or a link to the notable change suggested text comment. Otherwise, the commit will be placed in the Other Notable Changes section. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This pull request introduces the experimental
--allow-netCLI flag, extending Node.js's Permission Model to manage network access explicitly. When enabled, processes require explicit permission to access network resources.For now, let's flag it as
semver-majorbecause for actual users of Permission Model, this will be a breaking change (requiring them to pass--allow-netto get back to the current behaviour).This initial implementation is a boolean; either you allow network access (inbound and outgoing) or you don't. I will check how feasible it is to make it more granular (e.g:
--allow-net="https://nodejs.org")Notable Change
The Permission Model now gets an extension to check network access (HTTP, HTTPS, DNS, TCP and UDP) and a new flag to allow it (
--allow-net).$ node --permission --allow-net index.js