Skip to content

Conversation

@RafaelGSS
Copy link
Member

@RafaelGSSRafaelGSS commented Jun 23, 2023

When two paths overlaps, the permission model returns a false negative cause the Node* doesn't contain an empty child ("") to consider it as an end node. For instance, if you call --allow-fs-read=/home/index.js,/home/index.json and call process.permission.has for both paths, it will return false for the index.js since it will create the following radix tree:

Child / Prefix: /home/index.js Child o Prefix: on End of tree: on End of tree(c): /home/index.js End of tree(c): 

and if you invert the parameters order: --allow-fs-read=/home/index.json,/home/index.js it will create an empty child for "/home/index.js" indicating "end node".

To handle it I've included a new parameter to Node*: is_leaf.

@nodejs-github-bot
Copy link
Collaborator

Review requested:

  • @nodejs/security-wg

@nodejs-github-botnodejs-github-bot added c++ Issues and PRs that require attention from people who are familiar with C++. needs-ci PRs that need a full CI run. labels Jun 23, 2023
@RafaelGSSRafaelGSSforce-pushed the fix-leaf-node-perm-model branch from d301f50 to 394d0eaCompareJune 23, 2023 19:47
@RafaelGSSRafaelGSS added the request-ci Add this label to start a Jenkins CI on a PR. label Jun 23, 2023
@github-actionsgithub-actionsbot removed the request-ci Add this label to start a Jenkins CI on a PR. label Jun 23, 2023
@nodejs-github-bot
Copy link
Collaborator

@anonriganonrig added the author ready PRs that have at least one approval, no pending requests for changes, and a CI started. label Jun 24, 2023
@RafaelGSSRafaelGSS added the commit-queue Add this label to land a pull request using GitHub Actions. label Jun 25, 2023
@nodejs-github-botnodejs-github-bot removed the commit-queue Add this label to land a pull request using GitHub Actions. label Jun 25, 2023
@nodejs-github-botnodejs-github-bot merged commit b38bc9f into nodejs:mainJun 25, 2023
@nodejs-github-bot
Copy link
Collaborator

Landed in b38bc9f

RafaelGSS added a commit that referenced this pull request Jul 3, 2023
PR-URL: #48531 Reviewed-By: Yagiz Nizipli <[email protected]> Reviewed-By: Juan José Arboleda <[email protected]>
@RafaelGSSRafaelGSS mentioned this pull request Jul 3, 2023
@tniessentniessen added the permission Issues and PRs related to the Permission Model label Aug 10, 2023
Ceres6 pushed a commit to Ceres6/node that referenced this pull request Aug 14, 2023
PR-URL: nodejs#48531 Reviewed-By: Yagiz Nizipli <[email protected]> Reviewed-By: Juan José Arboleda <[email protected]>
Ceres6 pushed a commit to Ceres6/node that referenced this pull request Aug 14, 2023
PR-URL: nodejs#48531 Reviewed-By: Yagiz Nizipli <[email protected]> Reviewed-By: Juan José Arboleda <[email protected]>
@ruyadorno
Copy link
Member

This commit does not land cleanly on v18.x-staging and will need manual backport in case we want it in v18.

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

author readyPRs that have at least one approval, no pending requests for changes, and a CI started.c++Issues and PRs that require attention from people who are familiar with C++.needs-ciPRs that need a full CI run.permissionIssues and PRs related to the Permission Model

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants

@RafaelGSS@nodejs-github-bot@ruyadorno@anonrig@juanarbol@tniessen