-
Notifications
You must be signed in to change notification settings - Fork 5.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
import.meta.url exposes full file path even when no permissions are given #10379
Comments
Third-party code can access it, but unless you give Deno access to the filesystem or the network it can't really do anything with it. I'm assuming the concern here is that a third-party library could phone back home and collect information about you without your consent. In that case, I would suggest allowlisting the allowed domain names in the |
Actually, remote code can not access your local path name without |
@wperron Yep, I mentioned that in the issue
@lucacasonato Maybe you were replying to wperron rather than me, but in the issue I said "and so running some random code that I've downloaded from the internet", meaning to imply that I've downloaded the code to my machine, and then ran it. I agree that this is a nice extra layer of protection though (given that most people will be running code via a URL). And actually, testing this by loading a HTML file with That said, it's quite rare that developers run HTML files on their machine without a local webserver, since a lot of functionality is disabled, so arguably Deno should behave more like the webserver case. I guess that would probably imply that (Off-topic, but that makes me think: Maybe the solution to #2150 is to disallow In any case, I'll trust that y'all know what you're doing here - I just thought I'd open this issue in case this was not expected behavior, or in case it could so with some discussion. Please feel free to close if this is considered resolved. |
This is known and intentional. Another case where explicitly downloading modules as opposed running them remotely will grant them an extra privilege is them being immune to #5050. When doing this, users need to take their own measures like putting these modules in an obscured path or using a scoped import map to limit what they can import. |
Closing this as working as intended. |
It's also worth pointing out that all paths are also accessible in stack traces! console.log(new Error().stack); |
If I create a script:
and run it like this:
then it logs this:
This is surprising to me, but maybe I'm missing something. I tend to think of Deno like a web browser - and so running some random code that I've downloaded from the internet shouldn't tell someone my name (assuming, for example, that I set
--allow-net
so they could actually exfiltrate that data).It seems significant enough that there is probably an existing discussion/resolution on it, but I couldn't find an issue explaining or mentioning this - so apologies if it has already been brought up!
The text was updated successfully, but these errors were encountered: