feat: Deno.execPath() no longer requires --allow-read permission #29620
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This commit changes
Deno.execPath()
API to no longer requireread permission.
This change is dictated by the fact that in common scenarios, requiring
read permission is less secure than not requiring permissions - if
a user wants to spawn a Deno subprocess using the current executable,
they would do something like:
To run this program, currently one needs to pass
--allow-read --allow-run=deno
flags.It's possible to limit scope of
--allow-read
flag, but it's really cumbersome to do,so most users will opt to give a blanket
--allow-read
permission.Not requiring read permissions allows the above program to be run with
just
--allow-run=deno
flag.This change is in similar to relaxing of permissions in
Deno.cwd()
API donein #27192.
Ref #20061 (comment)